CVE-2026-39362
High
Description
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, when INVENTREE_DOWNLOAD_FROM_URL is enabled (opt-in), authenticated users can supply remote_image URLs that are fetched server-side via requests.get() with only Django's URLValidator check. There is no validation against private IP ranges or internal hostnames. Redirects are followed (allow_redirects=True), enabling bypass of any URL-format checks. This vulnerability is fixed in 1.2.7 and 1.3.0.
SeverityHigh
CVSS7.1
Exploit probability—
ProductInventree
PublishedApr 8, 2026
First seenApr 8, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- inventree_project inventree1.2.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| inventree_project inventree | v < 1.2.7 | 1.2.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.