EUVD-2026-39423
GHSA-f658-prxw-vx8p
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered but requires low-privilege auth and user interaction; CSP prevents script execution, limiting impact to phishing-grade HTML injection with no availability consequence.
Primary rating from Vendor (rami.io).
CVSS VectorVendor: rami.io
Lifecycle Timeline
2DescriptionCVE.org
Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Policy, this can mainly be used for phishing purposes.
AnalysisAI
HTML injection on the pretix untrusted-redirect warning page enables phishing attacks against end users. Affecting the open-source event ticketing platform (all versions prior to 2026.5.2), authenticated low-privileged users can embed malicious HTML content into the redirect interstitial page that pretix displays before forwarding visitors to external URLs. The presence of a Content-Security-Policy on that page blocks script execution, so the primary attack surface is social engineering and credential phishing rather than full cross-site scripting. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
pretix (CPE: cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:*) is an open-source, self-hosted event registration and ticketing platform. The vulnerability is classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page), a basic HTML/XSS injection where attacker-controlled data is rendered as markup without adequate sanitization. The specific sink is the redirect-warning interstitial page that pretix renders when a user is about to be forwarded to an untrusted external URL. Because this page enforces a Content-Security-Policy, injected JavaScript is blocked by the browser; however, arbitrary HTML elements - fake login forms, misleading text, hidden iframes, or spoofed UI elements - can still be rendered, making the page suitable as a phishing vector. The root cause is insufficient output encoding of URL-derived or user-supplied content on that specific template.
RemediationAI
Upgrade pretix to version 2026.5.2 or later, as documented in the vendor release blog at https://pretix.eu/about/en/blog/20260625-release-2026-5-2/. This is the primary and recommended fix. If immediate patching is not possible, operators can reduce exposure by restricting which users or roles are permitted to configure external redirect URLs within pretix, thereby limiting the pool of accounts capable of injecting malicious HTML content. Additionally, educating event attendees to scrutinize redirect warning pages for unexpected content provides a partial defence-in-depth control. Note that the existing CSP already prevents script-based exploitation; the residual risk is purely phishing-oriented HTML injection, so the urgency of compensating controls is proportionate to the sensitivity of the attendee user base.
pretix before 2024.1.1 mishandles file validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
Server-side URL manipulation in the pretix-oppwa payment plugin (fixed in pretix 2026.5.3) lets a remote attacker exfilt
Stored cross-site scripting in Pretix's PDF ticket and badge layout editor allows one backend user to inject JavaScript
pretix before 2023.7.2 allows Pillow to parse EPS files. Rated high severity (CVSS 7.8), this vulnerability is no authen
Privilege escalation to full account takeover in pretix (open-source event ticketing) and its payment integration plugin
rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. Rated high severity (CVSS
Venueless instances allow authenticated users with 'update world' permissions to exfiltrate chat messages from direct me
Cross-world user deletion in venueless allows authenticated API users with 'manage users' permission in one world to del
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tag
Information disclosure in Pretix email template processing allows authenticated backend users to extract sensitive syste
Information disclosure in Pretix email template processing allows authenticated backend users to extract sensitive syste
Payment status replay in pretix-mollie allows unauthenticated attackers to obtain multiple valid event tickets by reusin
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today