InvenTree — Vulnerabilities & Security Advisories 10

All 10 CVE vulnerabilities found in InvenTree, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-39362	InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs CWE-918	7.1^AI	High^AI	2026-04-08
CVE-2026-35479	InvenTree Plugin Installation - Insufficient Permissions CWE-285	6.6	Medium	2026-04-08
CVE-2026-35476	InvenTree Affected by Privilege Escalation via API CWE-285	7.2	High	2026-04-08
CVE-2026-35478	InvenTree has Arbitrary API Token Creation CWE-639	8.3	High	2026-04-08
CVE-2026-35477	InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape CWE-1336	5.5	Medium	2026-04-08
CVE-2026-33531	InvenTree has Path Traversal In Report Templates CWE-89	4.9	-	2026-03-26
CVE-2026-33530	InvenTree Vulnerable to ORM Filter Injection CWE-202	7.7	High	2026-03-26
CVE-2026-27629	InvenTree Vulnerable to Server Side Template Injection (SSTI) CWE-1336	5.9	Medium	2026-02-25
CVE-2025-49000	InvenTree has uncontrolled memory allocation via built-in label-sheet plugin CWE-400	3.5	Low	2025-06-03
CVE-2024-47610	Stored Cross-site Scripting Vulnerability in Markdown Editor CWE-79	7.3	High	2024-10-07

All 10 known CVE vulnerabilities affecting InvenTree with full Chinese analysis, references, and POCs where available.