A path traversal flaw in InvenTree’s report template engine permits a user with staff privileges to read arbitrary files from the server’s filesystem by embedding crafted template tags. The vulnerability affects the functions encode_svg_image(), asset(), and uploaded_image() in the report tags module. If the host system grants high privileges to the InvenTree process, an attacker can access files outside the application’s source directory, potentially exposing sensitive data. The primary consequence is unauthorized disclosure of information, rather than code execution or denial of service.

The flaw exists in all versions of InvenTree before 1.2.6, including installations that backported this issue. The patch is available starting with release 1.2.6 and is also present in 1.3.0 and later. Users running any pre‑1.2.6 version, or operating an older 1.2.x release, are vulnerable. No other vendors or products are affected.

The CVSS score is 4.9, indicating low severity, and the EPSS score is below 1 %, suggesting a very low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires staff‑level access to upload or edit report templates, so an attacker must already have legitimate credentials or compromise a staff user. If high system privileges are in use, the risk of accessing critical files increases, but the overall likelihood of a successful attack remains modest.