Is there a patch available for EUVD-2026-39418?

Yes, a patch is available for EUVD-2026-39418. Update the affected software to the latest version immediately.

pretix EUVD-2026-39418

Q: What is the CVSS score of EUVD-2026-39418?

EUVD-2026-39418 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-13225 MEDIUM

Basic XSS (CWE-80)

2026-06-25 rami.io

GHSA-g3hf-77hr-rvcr

XSS Pretix

5.3

CVSS 4.0 · Vendor: rami.io

Severity by source

Vendor (rami.io) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-accessible unauthenticated input triggers scope change as injected script executes in victim's browser; no availability impact applies to basic XSS.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (rami.io).

CVSS VectorVendor: rami.io

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 16:03 EUVD

Analysis Generated

Jun 25, 2026 - 15:20 vuln.today

DescriptionCVE.org

Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.

AnalysisAI

HTML injection on pretix's individual ticket confirmation page allows unsanitized email address content to execute arbitrary HTML - including scripts - in the browser of anyone who views that page. The injection point is the email address field submitted at order creation, which pretix stored and rendered without output encoding on the per-ticket confirmation view. Exploitation requires no authentication (PR:N in CVSS 4.0) but does require a victim to load the affected page (UI:P). No public exploit is identified and the vulnerability is not listed in CISA KEV; a vendor-released patch is available in version 2026.5.2.

Technical ContextAI

CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) describes a failure to apply HTML output encoding before injecting user-controlled data into a rendered page - the classic root cause of basic stored XSS. pretix is an open-source event ticketing platform (CPE: cpe:2.3:a:pretix:pretix:*) that allows event organizers to sell and manage tickets; orders carry attendee-supplied metadata including an email address. The confirmation page for individual tickets within an order reflects that email address back into the HTML document body without sanitization, allowing injected tags such as <script> or <img onerror=...> to be interpreted by the victim's browser as live markup rather than data.

RemediationAI

Upgrade pretix to version 2026.5.2 or later, as documented in the vendor release blog at https://pretix.eu/about/en/blog/20260625-release-2026-5-2/. Self-hosted operators should apply this update as soon as operationally feasible. If an immediate upgrade is not possible, a compensating control is to restrict access to the individual ticket confirmation pages to authenticated and trusted users only, which would raise the effective privilege bar for payload execution - note this may break legitimate ticket-holder access flows. A Web Application Firewall rule stripping script-related HTML tags from email input fields can reduce risk but is not a reliable substitute for code-level output encoding, as it is bypassable via encoding variants.