InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs

The SSRF vulnerability in InvenTree allows an authenticated attacker to bypass URL validation checks and make requests to internal or external resources. By manipulating the remoteimage URL, an attacker can potentially access sensitive internal services, read internal files, or even interact with internal APIs. The allowredirects=True setting exacerbates the issue, enabling bypass of any URL format checks. This could lead to data exfiltration, denial of service, or further exploitation of internal systems if they are vulnerable. The blast radius extends to any internal resources accessible via HTTP/HTTPS from the InvenTree server.

Organizations using InvenTree for inventory management, particularly those with the INVENTREEDOWNLOADFROM_URL setting enabled, are at risk. Shared hosting environments where InvenTree is deployed alongside other applications are also vulnerable, as a compromised InvenTree instance could potentially be used to attack other services on the same server.

• python / server:

# Check for the presence of the vulnerable code in the InvenTree codebase.
grep -r 'requests.get(url, allow_redirects=True)' /path/to/inventree/source

• generic web:

# Monitor access logs for requests to internal IP addresses or unusual domains originating from authenticated InvenTree users.
grep '127.0.0.1' /var/log/apache2/access.log

1. 2026-04-08Disclosure

   disclosure

1. Reservado2026-04-06
2. Publicada2026-04-08
3. Modificada2026-04-10
4. EPSS atualizado2026-04-16

The primary mitigation for CVE-2026-39362 is to upgrade InvenTree to version 1.2.7 or 1.3.0, which includes the necessary fixes. If upgrading is not immediately feasible, disable the INVENTREEDOWNLOADFROM_URL setting in the InvenTree configuration. This will prevent the vulnerable functionality from being used. As a temporary workaround, implement a Web Application Firewall (WAF) or proxy to filter outbound requests and block those targeting internal IP ranges or suspicious domains. Regularly review InvenTree's configuration and access controls to minimize the potential impact of this vulnerability. After upgrade, confirm by attempting to trigger the vulnerable functionality with a known malicious URL and verifying that the request is blocked.