Is there a patch available for EUVD-2026-39420?

Yes, a patch is available for EUVD-2026-39420. Update the affected software to the latest version immediately.

Pretix EUVD-2026-39420

Q: What is the CVSS score of EUVD-2026-39420?

EUVD-2026-39420 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-57535 LOW

Basic XSS (CWE-80)

2026-06-25 rami.io

GHSA-gjw6-qpff-pf5x

XSS SSRF Pretix

2.1

CVSS 4.0 · Vendor: rami.io

Severity by source

Vendor (rami.io) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.1 MEDIUM

Network vector, low privileges required, user interaction needed to trigger PDF generation, scope changes due to SSRF reaching other systems, confidentiality-only impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (rami.io).

CVSS VectorVendor: rami.io

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 16:03 EUVD

Analysis Generated

Jun 25, 2026 - 15:21 vuln.today

DescriptionCVE.org

Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these images pointed to an URL, the PDF rendering engine would download the image from that place and display it, thereby leaking information about the rendering server and possibly creating an SSRF vector in the local network.

AnalysisAI

HTML injection into server-side PDF rendering contexts in Pretix enables low-privileged authenticated users to embed external image references that trigger outbound HTTP requests from the rendering engine, leaking the server's network identity and creating an SSRF vector against internal network services. The CVSS 4.0 score of 2.1 reflects genuinely low severity - exploitation requires authentication, specific content reaching PDF rendering paths, and passive user interaction to trigger PDF generation. No public exploit code exists and this vulnerability is absent from CISA KEV.

Technical ContextAI

Pretix is an open-source event ticket shop platform (CPE: cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:*) that generates PDF documents including order confirmations and event tickets. The root cause is CWE-80 (Improper Neutralization of Script-Related HTML Tags), where user-controlled content injected into PDF rendering contexts is not stripped of HTML markup before processing. Critically, the server-side PDF rendering engine interprets <img> tags with external src URLs and performs live outbound HTTP GET requests to fetch those images. This server-side fetch exposes the rendering host's real IP address, HTTP client headers, and network identity to attacker-controlled infrastructure, and the same mechanism can be directed at RFC 1918 private addresses to probe or fingerprint services on the internal network co-located with the Pretix server.

RemediationAI

Upgrade Pretix to version 2026.5.2, as documented in the vendor release announcement at https://pretix.eu/about/en/blog/20260625-release-2026-5-2/. This release addresses HTML injection into PDF rendering contexts. If immediate upgrade is not possible, two compensating controls are available: first, sanitize or reject HTML tags - particularly <img> elements with external src attributes - at the application input layer for any fields that feed into PDF generation (trade-off: may break intentional rich-text formatting if any is permitted); second, implement network-level egress filtering on the Pretix server host to block outbound HTTP/HTTPS requests to untrusted external hosts and to RFC 1918 private IP ranges, which neutralizes both the information leakage and the SSRF lateral movement risk without requiring application changes (trade-off: may affect legitimate external image embedding if the product supports it by design).