pretix up to 2026.3.3/2026.4.3/2026.5.1 cross site scripting

Summaryinfo

A vulnerability identified as problematic has been detected in pretix up to 2026.3.3/2026.4.3/2026.5.1. The affected element is an unknown function. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-57532. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in pretix up to 2026.3.3/2026.4.3/2026.5.1. This issue affects some unknown functionality. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. Impacted is integrity. The summary by CVE is:

Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of another backend user. Due to requirements of the PDF rendering and editing libraries used, this is one of the few pages in our backend that do not have a strong Content-Security-Policy that would render this capability useless for most scenarios.

It is possible to read the advisory at pretix.eu. The identification of this vulnerability is CVE-2026-57532 since 06/24/2026. The exploitation is known to be easy. The attack may be initiated remotely. Additional levels of successful authentication are required for exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

Upgrading to version 2026.3.4, 2026.4.4 or 2026.5.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-39425). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• pretix

Version

• 2026.3.0
• 2026.3.1
• 2026.3.2
• 2026.3.3
• 2026.4.0
• 2026.4.1
• 2026.4.2
• 2026.4.3
• 2026.5.0
• 2026.5.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion