{"id":"CVE-2026-61749","revision":"5b4c3545e8354eba82e93ceb48c8b14a","records":[{"revision":"5b4c3545e8354eba82e93ceb48c8b14a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-61749","aliases":[],"title":"InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure","description":"InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The HTML(string=html).write_pdf() path does not provide a restricted url_fetcher, and attach_to_model=True stores the original generated PDF before later processing, allowing fetched local files or internal HTTP response bodies to be recovered from embedded attachments. This enables full-read server-side request forgery, arbitrary local file disclosure including application credentials, and possible compromise of a superuser account. This issue is fixed in version 1.4.0.","state":0,"publishedAt":"2026-09-21T18:31:54.532+00:00","modifiedAt":"2026-09-24T22:29:20.432+00:00","affected":[{"ecosystem":"Vendor product","name":"InvenTree","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"inventree\",\n                    \"product\": \"InvenTree\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.4.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/inventree/InvenTree/security/advisories/GHSA-568x-qh23-wh8g","https://github.com/inventree/InvenTree/pull/12160","https://github.com/inventree/InvenTree/commit/2b4f3037703bd499e420b6904153f2b66878d61b","https://github.com/inventree/InvenTree/releases/tag/1.4.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-61749","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-61749","identifiers":["CVE-2026-61749"]},"retained":false,"historicalAffected":[]}],"coverage":[]}