Inventree CVE-2026-39362

CVSS 5.3 (Medium) with Attack Vector Network, Low Complexity, and Low Privilege requirement reflects the authentication gate: the vulnerability requires valid user credentials (PR:L), limiting the threat surface to insider threats or compromised accounts. The CVSS vector indicates Low Scope impact (SC:L) with Low Integrity and Low Availability impact (SI:L, SA:N), suggesting the vulnerability enables information disclosure rather than direct system compromise. However, SSRF vulnerabilities are inherently high-risk because they can chaininto severe attacks: an attacker can enumerate internal services, access cloud metadata (AWS EC2 role credentials, GCP tokens), exploit internal API endpoints without authentication, or pivot toward backend databases. The lack of a CISA KEV listing and absence of confirmed public exploit code suggests this is not currently mass-exploited, but the technical barrier to exploitation is extremely low once credentials are obtained. Real-world risk depends heavily on deployment context: air-gapped environments with strict network segmentation have low risk, while cloud-native deployments with overly permissive backend security groups have critical risk.

An authenticated attacker with InvenTree user credentials uploads an item and supplies a remote_image URL pointing to http://169.254.169.254/latest/meta-data/ (AWS EC2 metadata endpoint) or http://localhost:8000/admin/ (internal admin API). Due to the lack of IP-range validation and HTTP redirect following, the server fetches and potentially exposes sensitive data such as cloud credentials, API keys, or internal configuration. No public exploit code is required; the attack is a simple HTTP request with a malicious URL parameter, making exploitation trivial for any authenticated user.