Is there a patch available for CVE-2026-57534?

Yes, a patch is available for CVE-2026-57534. Update the affected software to the latest version immediately.

pretix-pages CVE-2026-57534

Q: What is the CVSS score of CVE-2026-57534?

CVE-2026-57534 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-39416 LOW

Basic XSS (CWE-80)

2026-06-25 rami.io

GHSA-8chh-vr7p-hqjf

XSS Pretix Pretix Pages

2.1

CVSS 4.0 · Vendor: rami.io

Severity by source

Vendor (rami.io) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

High privileges gate content injection; victim must view the page (UI:R); scope changes to affect other users' browsers, with no availability impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (rami.io).

CVSS VectorVendor: rami.io

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 16:03 EUVD

Analysis Generated

Jun 25, 2026 - 15:19 vuln.today

DescriptionCVE.org

Malicious HTML content could be injected into the content of a page in the pretix-pages plugin.

AnalysisAI

HTML injection in the pretix-pages plugin for Pretix event ticketing software permits a high-privileged authenticated user to embed malicious HTML tags into plugin-rendered page content, which subsequently executes in the browsers of site visitors who view those pages. All tracked versions under cpe:2.3:a:pretix:pretix-pages are affected, with a vendor-released fix published 2026-06-25 in Pretix release 2026.5.2. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

pretix-pages is a plugin for Pretix, an open-source self-hosted event ticketing platform used by conferences and event organizers. CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) identifies the root cause as insufficient sanitization of HTML tag content prior to rendering - the plugin writes attacker-controlled HTML directly into the DOM without stripping or escaping script-bearing tags. The CPE string cpe:2.3:a:pretix:pretix-pages:*:*:*:*:*:*:*:* with the wildcard version component indicates no bounded safe version is enumerated in the advisory data, meaning the vulnerability spans all tracked releases of the plugin. This is a classic stored HTML injection pattern: privileged content is written once to a persistent store and later served to any visitor of the affected page.

RemediationAI

Upgrade the pretix-pages plugin by updating Pretix to release 2026.5.2 or later, as detailed in the vendor advisory at https://pretix.eu/about/en/blog/20260625-release-2026-5-2/ published 2026-06-25. This is the primary and recommended fix. As a compensating control prior to patching, restrict page-editing privileges within Pretix to only the minimum required set of trusted administrators, reducing the number of accounts capable of injecting content - note this trades operational flexibility for reduced insider risk. Additionally, audit existing pretix-pages content for unexpected HTML tags or embedded script elements as a detection measure. No workaround eliminates the underlying sanitization defect without patching.