InvenTree CVE-2026-61749

Requires an authenticated STAFF user with permission to author report or label templates - template upload is restricted to staff in InvenTree, so this is not exploitable by ordinary authenticated users or unauthenticated attackers. The vulnerable path is the default report/label rendering behavior in versions prior to 1.4.0, where WeasyPrint's HTML(string=html).write_pdf() runs with no restricted url_fetcher; no non-default configuration is needed to reach it. Exploitation is limited by: (1) the staff/template-author privilege requirement, (2) the need to retrieve the stored PDF attachment (enabled by attach_to_model=True) to recover fetched bytes, and (3) for internal-service SSRF, the target http/https endpoint must be reachable from the InvenTree server. After the 1.4.0 fix, file:// is always blocked and http/https are disabled unless the REPORT_FETCH_URLS setting is explicitly enabled.

This is a genuine but access-gated issue, not a spray-and-pray internet threat. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, base 6.5) hinges on PR:H, which is well-founded: the vendor advisory and fix documentation confirm report/label template authoring is restricted to STAFF users only, so the attacker must already hold a privileged, trusted role. No EPSS score, no CISA KEV listing, and no public exploit code were provided - exploitation status is therefore 'no public exploit identified at time of analysis.' The C:H/I:H is credible because the flaw yields full-read SSRF plus arbitrary local file disclosure (including application credentials) that can cascade to superuser compromise; however the direct primitive is read-only, and the integrity impact is an indirect consequence of stolen credentials rather than a direct write, so I assess I:L rather than the vendor's I:H. No conflicting-signal problems in the vector, but note the realistic risk is materially lower than the 6.5 suggests because it requires an already-privileged insider (or a compromised staff account) rather than any authenticated user - this is an insider/post-compromise escalation-of-access issue, not a perimeter breach.

A staff user with report/label template authoring rights (or an attacker who has phished/compromised such an account) uploads a template whose HTML references a file:// path such as the InvenTree settings/secret file, or an internal http:// URL like a cloud metadata endpoint. WeasyPrint renders the template with no restricted url_fetcher, and because attach_to_model=True stores the original generated PDF, the attacker later downloads the report attachment and recovers the embedded file contents or internal HTTP response body - disclosing application credentials that enable superuser takeover. No public exploit code is identified, but the mechanism is fully documented in the vendor advisory and fix commit.