inventree

Records21All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high7CVSS 7.0–8.9

Exploited now

inventree records in CISA KEV

No inventree vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Inventree 15 records MEDIUM

Records

15 records in Inventree · all components

TI-2022-03101 CVE-2022-3355 · GHSA-62g7-fpv9-v95f

Cross-site Scripting (XSS) - Stored in inventree/inventree

MEDIUM 64

Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.8.3.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00873 Published 2022-09-29 Fixed in 0.8.3 CWE-79

TI-2026-27607 CVE-2026-35477

InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape

MEDIUM 42

InvenTree is an Open Source Inventory Management System.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00269 Published 2026-04-08 Fixed in 1.2.7 CWE-1336

TI-2022-01953 CVE-2022-2112 · GHSA-9hx5-jmxv-x44q

Improper Neutralization of Formula Elements in a CSV File in inventree/inventree

MEDIUM 41

Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01303 Published 2022-06-17 Fixed in 0.7.2 CWE-1236

TI-2022-01952 CVE-2022-2111 · GHSA-fr2w-mp56-g4xp

Unrestricted Upload of File with Dangerous Type in inventree/inventree

MEDIUM 41

Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01258 Published 2022-06-17 Fixed in 0.7.2 CWE-434

TI-2026-27608 CVE-2026-35478

InvenTree has Arbitrary API Token Creation

LOW 38

InvenTree is an Open Source Inventory Management System.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00308 Published 2026-04-08 Fixed in 1.2.7 CWE-639

TI-2026-22011 CVE-2026-27629

InvenTree Vulnerable to Server Side Template Injection (SSTI)

LOW 38

InvenTree is an Open Source Inventory Management System.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00288 Published 2026-02-25 Fixed in 1.2.3 CWE-1336

TI-2024-31890 CVE-2024-47610

Stored Cross-site Scripting Vulnerability in Markdown Editor

LOW 34

InvenTree is an Open Source Inventory Management System.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00316 Published 2024-10-07 Fixed in 0.16.5 CWE-79

TI-2026-25923 CVE-2026-33530

InvenTree Vulnerable to ORM Filter Injection

LOW 33

InvenTree is an Open Source Inventory Management System.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00207 Published 2026-03-26 Fixed in 1.2.6 CWE-202

TI-2026-27606 CVE-2026-35476

InvenTree Affected by Privilege Escalation via API

LOW 31

InvenTree is an Open Source Inventory Management System.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00147 Published 2026-04-08 Fixed in 1.2.7 CWE-285

TI-2022-01975 CVE-2022-2134 · GHSA-fx8r-hf6c-5p46

Allocation of Resources Without Limits or Throttling in inventree/inventree

LOW 30

Allocation of Resources Without Limits or Throttling in GitHub repository inventree/inventree prior to 0.8.0.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00853 Published 2022-06-20 Fixed in 0.8.0 CWE-770

TI-2026-27609 CVE-2026-35479

InvenTree Plugin Installation - Insufficient Permissions

LOW 29

InvenTree is an Open Source Inventory Management System.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.0022 Published 2026-04-08 Fixed in 1.2.7 CWE-285

TI-2025-31128 CVE-2025-49000

InvenTree has uncontrolled memory allocation via built-in label-sheet plugin

LOW 26

InvenTree is an Open Source Inventory Management System.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00356 Published 2025-06-03 Fixed in 0.17.13 CWE-400

TI-2022-01954 CVE-2022-2113 · GHSA-j5vv-p22h-45m3

Cross-site Scripting (XSS) - Stored in inventree/inventree

LOW 26

Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00803 Published 2022-06-17 Fixed in 0.7.2 CWE-79

TI-2026-28349 CVE-2026-39362

InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs

LOW 24

InvenTree is an Open Source Inventory Management System.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00237 Published 2026-04-08 Fixed in 1.2.7 CWE-918

TI-2026-25924 CVE-2026-33531

InvenTree has Path Traversal In Report Templates

LOW 22

InvenTree is an Open Source Inventory Management System.

CVSS 4.0MEDIUM 4.9 Network Low privileges No interaction EPSS 0.00304 Published 2026-03-26 Fixed in 1.2.6 CWE-89

Open these records in search →