Pretix

Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these images pointed to an URL, the PDF rendering engine would download the image from that place and display it, thereby leaking information about the rendering server and possibly creating an SSRF vector in the local network.

Published: 2026-06-25T14:29:18.531Z
Updated: 2026-06-25T15:10:48.584Z

Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Policy, this can mainly be used for phishing purposes.

Published: 2026-06-25T14:31:18.968Z
Updated: 2026-06-25T15:05:14.046Z

Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of another backend user. Due to requirements of the PDF rendering and editing libraries used, this is one of the few pages in our backend that do not have a strong Content-Security-Policy that would render this capability useless for most scenarios.

Published: 2026-06-25T14:32:37.967Z
Updated: 2026-06-25T15:04:24.738Z

Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.

Published: 2026-06-25T14:26:31.972Z
Updated: 2026-06-25T15:11:12.132Z

When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards. This is inconsistent with the UI and API where only the first letters of the gift card secret are shown. Therefore, it allows circumventing a permission boundary.

Published: 2026-06-09T11:54:37.865Z
Updated: 2026-06-09T13:49:42.672Z