Which versions of Pretix are affected by EUVD-2026-39425?

Pretix, an open-source event ticketing platform, contains a security flaw in its administrator ticket editor that allows a malicious administrator to compromise other administrator accounts through…. A patch is available.

How to fix or mitigate EUVD-2026-39425?

Within 24 hours: Identify and document all Pretix deployments in use, their current versions, and production status. Within 7 days: Deploy Pretix version 2026.5.2 or later to all instances, prioritizing production environments managing active events. Within 30 days: Audit PDF editor access logs for suspicious activity and restrict backend editor permissions to authorized personnel only.

Pretix EUVD-2026-39425

Q: What is the CVSS score of EUVD-2026-39425?

EUVD-2026-39425 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-57532 HIGH

Basic XSS (CWE-80)

2026-06-25 rami.io

GHSA-4jgq-8mwg-w9q9

XSS Pretix

8.8

CVSS 4.0 · Vendor: rami.io

Severity by source

Vendor (rami.io) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.7 HIGH

Authenticated backend user injects stored XSS (PR:L), victim must open the editor (UI:R), and execution in another user's browser context crosses a trust boundary (S:C) with high confidentiality/integrity but no direct availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (rami.io).

CVSS VectorVendor: rami.io

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 16:03 EUVD

Analysis Generated

Jun 25, 2026 - 15:16 vuln.today

CVE Published

Jun 25, 2026 - 14:32 cve.org

HIGH 8.8

DescriptionCVE.org

Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of another backend user. Due to requirements of the PDF rendering and editing libraries used, this is one of the few pages in our backend that do not have a strong Content-Security-Policy that would render this capability useless for most scenarios.

AnalysisAI

Stored cross-site scripting in Pretix's PDF ticket and badge layout editor allows one backend user to inject JavaScript that executes in another backend user's browser when they open the PDF editor. Affected is the open-source Pretix event-ticketing platform on versions prior to the 2026.5.2 release; the malicious HTML embedded in a layout specification runs because the PDF editor page is one of the few backend pages that lacks a strong Content-Security-Policy. There is no public exploit identified at time of analysis, but the vendor has confirmed and patched the issue.

Technical ContextAI

Pretix is a widely used open-source self-hosted ticketing and event-registration system written in Django/Python. The flaw is a CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page / Basic XSS) issue: HTML stored inside a PDF ticket or badge layout specification is rendered and executed verbatim when the in-browser PDF editor loads it. The root cause is twofold - layout content is not sanitized/neutralized before being placed into the DOM, and the PDF rendering/editing libraries (e.g. PDF.js-style client-side editors) require relaxed framing/inline-script handling, so this particular page intentionally omits the strict Content-Security-Policy that protects the rest of the Pretix backend and would otherwise neutralize the injected script. The affected CPE is cpe:2.3:a:pretix:pretix.

RemediationAI

Vendor-released patch: upgrade Pretix to release 2026.5.2 (or later), per the vendor advisory at https://pretix.eu/about/en/blog/20260625-release-2026-5-2/, which is the primary and recommended fix. Self-hosted operators running Docker or pip installations should update their image/package and restart services. As an interim compensating control where immediate patching is not possible, restrict who holds backend accounts with PDF ticket/badge layout edit permissions to a minimal set of fully trusted staff (this reduces the pool of potential injectors but does not eliminate risk if any such account is compromised), and avoid opening untrusted or unexpected layouts in the PDF editor. Operators with reverse-proxy control may also consider adding a Content-Security-Policy header to the layout editor endpoints, but be aware this can break the PDF rendering/editing libraries that the page depends on - which is precisely why Pretix omitted strict CSP there - so test carefully before deploying.