InvenTree’s report template engine is vulnerable to a path‑traversal flaw that lets a staff‑level user read arbitrary files from the server’s filesystem. By inserting specially crafted template tags into reports, the attacker can access files outside the InvenTree source directory if the process runs with elevated privileges. This can expose sensitive data such as configuration files or credentials, compromising confidentiality.

The flaw affects the open‑source inventory management system InvenTree released by inventree. Any installation running a pre‑1.2.6 build, or any version before the 1.3.0 release, is vulnerable. The issue is fixed in release 1.2.6 and all versions equal to or newer than 1.3.0. Systems that allow staff users to upload or edit report templates are at risk.

The CVSS score of 4.9 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated staff account with permission to modify templates, and no additional network access beyond the web interface is needed. The extent of data exposure depends on the privileges of the InvenTree process; if the process runs as root or with high privileges, the attacker could read sensitive system files.