GHSA-VX3H-QWQW-R2WQ

Inventree Server-Side Request Forgery vulnerability exposes server port/internal IP

Workarounds

To avoid this issue with unpatched versions, the "download image from remote URL" feature can be disabled in InvenTree, preventing users from accessing this information.

References

Thanks to @febin0x10 for identifying this vulnerability and reporting it to us as per our security policy.

The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user.

This error message may contain sensitive information about the server side request, including information about the availability of the remote resource.

Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.

GHSA-VX3H-QWQW-R2WQ has a CVSS score of 4.3 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.16.5); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client.

This patch has been applied to the upcoming 0.17.0 release, and also back-ported to the 0.16.5 stable release.

1. What is GHSA-VX3H-QWQW-R2WQ? GHSA-VX3H-QWQW-R2WQ is a medium-severity server-side request forgery (SSRF) vulnerability in inventree (pip), affecting versions < 0.16.5. It is fixed in 0.16.5. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
2. How severe is GHSA-VX3H-QWQW-R2WQ? GHSA-VX3H-QWQW-R2WQ has a CVSS score of 4.3 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of inventree are affected by GHSA-VX3H-QWQW-R2WQ? inventree (pip) versions < 0.16.5 is affected.
4. Is there a fix for GHSA-VX3H-QWQW-R2WQ? Yes. GHSA-VX3H-QWQW-R2WQ is fixed in 0.16.5. Upgrade to this version or later.
5. Is GHSA-VX3H-QWQW-R2WQ exploitable, and should I be worried? Whether GHSA-VX3H-QWQW-R2WQ is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-VX3H-QWQW-R2WQ is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-VX3H-QWQW-R2WQ? Upgrade inventree to 0.16.5 or later.

Other vulnerabilities in inventree