Is there a patch available for CVE-2026-39362?

Yes, a patch is available for CVE-2026-39362. Update the affected software to the latest version immediately.

Python CVE-2026-39362

Q: What is the CVSS score of CVE-2026-39362?

CVE-2026-39362 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-20596 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-08 security-advisories@github.com

SSRF Python

5.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.2.7

EUVD ID Assigned

Apr 08, 2026 - 20:23 euvd

EUVD-2026-20596

Analysis Generated

Apr 08, 2026 - 20:23 vuln.today

CVE Published

Apr 08, 2026 - 20:16 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, when INVENTREE_DOWNLOAD_FROM_URL is enabled (opt-in), authenticated users can supply remote_image URLs that are fetched server-side via requests.get() with only Django's URLValidator check. There is no validation against private IP ranges or internal hostnames. Redirects are followed (allow_redirects=True), enabling bypass of any URL-format checks. This vulnerability is fixed in 1.2.7 and 1.3.0.

AnalysisAI

Server-side request forgery (SSRF) in InvenTree prior to versions 1.2.7 and 1.3.0 allows authenticated users to request arbitrary internal URLs when the INVENTREE_DOWNLOAD_FROM_URL feature is enabled, bypassing URL validation through HTTP redirect chains. An attacker with valid credentials can probe internal networks, access cloud metadata endpoints, or interact with backend services not exposed to the public internet by supplying crafted remote_image URLs that are fetched server-side without IP-range restrictions.

Technical ContextAI

InvenTree's INVENTREE_DOWNLOAD_FROM_URL feature uses Python's requests.get() library to fetch images from user-supplied URLs. The vulnerability stems from reliance on Django's URLValidator alone, which performs format validation but does not restrict access to private IP address ranges (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses (127.0.0.0/8), or link-local addresses. The requests library's default behavior of following HTTP 3xx redirects (allow_redirects=True) further enables attackers to bypass initial URL-format checks by supplying a public URL that redirects to an internal target. This is classified as CWE-918: Server-Side Request Forgery (SSRF), a critical network-access control bypass.

RemediationAI

Upgrade InvenTree to version 1.2.7 or 1.3.0 or later, which includes server-side validation restricting requests to public IP address ranges and preventing SSRF via HTTP redirects. Users unable to upgrade immediately should disable INVENTREE_DOWNLOAD_FROM_URL in their configuration (set to False in settings). Additionally, implement network-layer controls: restrict outbound traffic from the InvenTree application server to only necessary external domains and block access to private IP ranges via firewall rules or container network policies. If INVENTREE_DOWNLOAD_FROM_URL must remain enabled, audit current users and restrict this feature to trusted administrators only. See https://github.com/inventree/InvenTree/security/advisories/GHSA-m9j7-jw3m-fr22 for official guidance.