InvenTree permits authenticated users to upload images by specifying a remote_image URL. The URLs are retrieved server‑side with requests.get() using only Django’s URLValidator, which does not validate against private IP ranges or internal hostnames. Redirects are automatically followed, allowing an attacker to point the download to an internal resource or a private IP address. The result is a classic SSRF where the InvenTree server can be coerced into making arbitrary HTTP requests, exposing internal data or enabling further network reconnaissance.

The vulnerability affects the InvenTree inventory management application. All versions prior to 1.2.7 and 1.3.0 are impacted when the INVENTREE_DOWNLOAD_FROM_URL feature is enabled. Users running earlier releases should update to the patched versions to eliminate the flaw.

The CVSS score of 5.3 indicates a moderate security impact. The EPSS score is not provided, and the flaw is not listed in the CISA KEV catalog, implying it has not been widely exploited. The attack requires an authenticated user with the download feature enabled, but does not require advanced access. Once authenticated, an attacker can supply a malicious remote_image URL and force the InvenTree server to resolve private or internal addresses, potentially leaking sensitive information or facilitating additional attacks.