CVE-2023-28459: PYSEC-2023-41 - pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents th

CVE-2023-28459 · Severity: low · CVSS 3.1 · Published 2023-04-20

Technologies: pretalx (PyPI). Vendors: PyPI.

Executive brief

pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files.

Affected products

PyPI pretalx

Related threats

pretalx stored XSS in organizer search typeahead
pretalx email injection in mail templates via unescaped placeholders
PYSEC-2023-40 - pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the overwriting (with the st