alonaki/inventree-path-traversal-cve-2026-33531This repository contains a professional write-up of a path traversal vulnerability discovered in InvenTree's report template engine. This vulnerability was patched in versions 1.2.6 and 1.3.0.
Advisory: GHSA-rhc5-7c3r-c769
CVE: CVE-2026-33531
Severity: Medium
Published: 2026-03-20
Credit: @alonaki
A path traversal vulnerability in the report template engine allows a staff-level user to read arbitrary files from the server filesystem via crafted template tags.
Affected functions in src/backend/InvenTree/report/templatetags/report.py:
encode_svg_image()asset()uploaded_image()This requires staff access (to upload / edit templates with maliciously crafted tags).
If the InvenTree installation is configured with high access privileges on the host system, this path traversal may allow file access outside of the InvenTree source directory.
| Status | Version |
|---|---|
| Vulnerable | < 1.2.6 |
| Patched | 1.2.6, 1.3.0 (and above) |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
| Metric | Value |
|---|---|
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | High |
| User Interaction | None |
| Scope | Changed |
| Confidentiality | High |
| Integrity | None |
| Availability | None |
Update to 1.2.6 or 1.3.0. No workarounds are available.
See the fix in #11579.
├── README.md
├── PoC/
│ ├── demo_template.txt # Example template
│ └── notes.md # Explains PoC
├── Technical-Analysis/
│ ├── vulnerable_functions.md
│ └── Attack-Flow.md
└── References/
└── links.md