CVE-2026-39362

OVERVIEW CVE-2026-39362 is a Server-Side Request Forgery (SSRF) vulnerability in InvenTree, an open-source inventory management system. The flaw exists in versions prior to 1.2.7 and 1.3.0 when the INVENTREE_DOWNLOAD_FROM_URL feature is enabled. Authenticated users can exploit insufficient URL validation to supply malicious remote image URLs that the server fetches server-side without proper checks against private IP ranges, internal hostnames, or redirect chains. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.1 (HIGH) with a network-based attack vector requiring low complexity and low privileges. Exploitation requires authentication but no user interaction. While confidentiality impact is low, integrity impact is rated high, indicating potential for unauthorized data modification or access to internal resources. The FAUCET risk score of 46.0/100 reflects moderate concern within the broader threat landscape. EXPLOITATION STATUS This vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active exploitation in the wild. The EPSS score of 0.00028 indicates minimal exploitation probability relative to other CVEs. No public exploit code is documented, and community attention remains limited. However, the attack's simplicity and low barrier to entry warrant monitoring for future exploitation attempts, particularly in environments where InvenTree is deployed with the optional download feature enabled.