A vulnerability, which was classified as critical , was found in InvenTree 1.2.6 . Affected is an unknown function. Such manipulation of the argument remote_image leads to server-side request forgery. This vulnerability is documented as CVE-2026-39362 . The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.
Full text archived locally
✦ AI Summary· Claude Sonnet
VDB-356037 · CVE-2026-39362 · GHSA-M9J7-JW3M-FR22
INVENTREE 1.2.6 REMOTE_IMAGE SERVER-SIDE REQUEST FORGERY
HISTORYDIFFRELATEJSONXMLCTI
CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score
4.8 $0-$5k 1.16+
Summaryinfo
A vulnerability has been found in InvenTree 1.2.6 and classified as critical. Affected by this vulnerability is an unknown functionality. Performing a manipulation of the argument remote_image results in server-side request forgery. This vulnerability is reported as CVE-2026-39362. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.
Detailsinfo
A vulnerability was found in InvenTree 1.2.6. It has been classified as critical. This affects an unknown part. The manipulation of the argument remote_image with an unknown input leads to a server-side request forgery vulnerability. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality, integrity, and availability.
The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-39362. The exploitability is told to be difficult. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available.
Upgrading to version 1.2.7 or 1.3.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 68031d504f799ecba5c1dd7bc9cbaf0daad9af0e is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.
Productinfo
Name
InvenTree
Version
1.2.6
License
open-source
Website
Product: https://github.com/inventree/InvenTree/
CPE 2.3info
🔒
CPE 2.2info
🔒
CVSSv4info
VulDB Vector: 🔒
VulDB Reliability: 🔍
CVSSv3info
VulDB Meta Base Score: 5.0
VulDB Meta Temp Score: 4.8
VulDB Base Score: 5.0
VulDB Temp Score: 4.8
VulDB Vector: 🔒
VulDB Reliability: 🔍
CVSSv2info
Vector Complexity Authentication Confidentiality Integrity Availability
Unlock Unlock Unlock Unlock Unlock Unlock
Unlock Unlock Unlock Unlock Unlock Unlock
Unlock Unlock Unlock Unlock Unlock Unlock
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploitinginfo
Class: Server-side request forgery
CWE: CWE-918
CAPEC: 🔒
ATT&CK: 🔒
Physical: No
Local: No
Remote: Yes
Availability: 🔒
Status: Not defined
Price Prediction: 🔍
Current Price Estimation: 🔒
0-Day Unlock Unlock Unlock Unlock
Today Unlock Unlock Unlock Unlock
Threat Intelligenceinfo
Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍
Countermeasuresinfo
Recommended: Upgrade
Status: 🔍
0-Day Time: 🔒
Upgrade: InvenTree 1.2.7/1.3.0
Patch: 68031d504f799ecba5c1dd7bc9cbaf0daad9af0e
Timelineinfo
04/08/2026 Advisory disclosed
04/08/2026 +0 days VulDB entry created
04/08/2026 +0 days VulDB entry last update
Sourcesinfo
Product: github.com
Advisory: GHSA-m9j7-jw3m-fr22
Status: Confirmed
Confirmation: 🔒
CVE: CVE-2026-39362 (🔒)
GCVE (CVE): GCVE-0-2026-39362
GCVE (VulDB): GCVE-100-356037
Entryinfo
Created: 04/08/2026 09:28
Changes: 04/08/2026 09:28 (56)
Complete: 🔍
Submitter: lakshay12311
Cache ID: 99:294:101
Submitinfo
Accepted
Submit #792375: InvenTree 1.2.6 Server-Side Request Forgery (by lakshay12311)
Discussion
No comments yet. Languages: en.
Please log in to comment.
◂ PreviousOverviewNext ▸