Executive brief
pretix, an open-source ticketing and event management platform, is vulnerable to a flaw where user-provided names are not properly cleaned before being included in automated emails. An attacker can use specially formatted names containing HTML or Markdown to inject links or custom text into emails sent by the system. While this cannot be used to take over the server, it allows attackers to create highly convincing phishing emails that appear to come from a trusted source.
Technical details
A content injection vulnerability exists in pretix due to improper encoding of user-supplied data in email templates. When placeholders like {name} are used, the system fails to strip or escape HTML and Markdown formatting provided by the user during registration. A remote, unauthenticated attacker can register with a crafted name to inject links or formatted text into emails sent to other users or administrators. While a strict HTML allow-list prevents Cross-Site Scripting (XSS), the flaw enables high-credibility phishing. The issue is fixed in versions 2025.7.3, 2025.8.2, and 2025.9.2.
Affected products
- rami.io pretix >= 1.0.0, < 2025.7.3; >= 2025.8.0, < 2025.8.2; >= 2025.9.0, < 2025.9.2
Timeline
- 2025-11-27: disclosed
- 2025-11-27: advisory
- 2025-11-27: patched