Executive brief
pretalx is an open-source conference management platform used to organize talks and schedules. A path traversal vulnerability in the HTML export feature allows organizers with administrative access to overwrite arbitrary files on the server with default error page content, potentially disrupting service or replacing important system files.
Technical details
A path traversal vulnerability (CWE-22) exists in pretalx's static HTML export functionality, affecting version 2.3.1. The vulnerability is located in the export_schedule_html.py management command, where insufficient path sanitization allows authenticated organizers to specify arbitrary file paths during export. An attacker with organizer privileges can craft malicious export requests to overwrite files outside the intended export directory with the standard pretalx 404 page content. The vulnerability requires authentication as an organizer and is triggered via the HTML export feature (a non-default capability). A patch is available in version 2.3.2 and later.
Affected products
- pretalx pretalx 2.3.1
Timeline
- 2023-04-20: disclosed: GHSA-23fx-92m6-4f2g and CVE-2023-28458 published
- 2023-04-20: patched: Fix released in pretalx v2.3.2