# CVE-2025-13742: rami.io pretix email content injection via attendee names

Source: https://junglewise.ai/threats/cve-2025-13742-rami-io-pretix-email-content-injection-via-attendee-names  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-27. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2025-13742 · Severity: medium · CVSS 6.1 · Published 2025-11-27

pretix, an open-source ticketing and event management platform, is vulnerable to a flaw where user-provided names are not properly cleaned before being included in automated emails. An attacker can use specially formatted names containing HTML or Markdown to inject links or custom text into emails sent by the system. While this cannot be used to take over the server, it allows attackers to create highly convincing phishing emails that appear to come from a trusted source.

Technologies: [Pretix](https://junglewise.ai/threats/technologies/pretix-pretix), [pretix (PyPI)](https://junglewise.ai/threats/technologies/pypi-pretix), [Rami.Io Pretix](https://junglewise.ai/threats/technologies/pretix). Vendors: [Pretix](https://junglewise.ai/threats/vendors/pretix), [PyPI](https://junglewise.ai/threats/vendors/pypi), [Rami.Io](https://junglewise.ai/threats/vendors/rami-io).

## Quick answers

**Is CVE-2025-13742 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13742 being exploited in the wild.

**How severe is CVE-2025-13742?** Medium severity, with a CVSS score of 6.1, published 27 November 2025.

**Which products and versions are affected?** pretix (PyPI) ECOSYSTEM:introduced=1.0.0,fixed=2025.7.2, ECOSYSTEM:introduced=1.0.0,fixed=2025.7.3; Rami.Io Pretix >= 1.0.0, < 2025.7.3; >= 2025.8.0, < 2025.8.2; >= 2025.9.0, < 2025.9.2.

**Is there a fix for CVE-2025-13742?** Yes. pretix (PyPI): upgrade to 2025.7.2, 2025.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-13742 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-13742?** Check whether you run Pretix, pretix (PyPI) or Rami.Io Pretix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pretix (PyPI): upgrade to 2025.7.2, 2025.7.3 or later

  ```sh
  pip install "pretix>=2025.7.3"
  ```


## Technical details

A content injection vulnerability exists in pretix due to improper encoding of user-supplied data in email templates. When placeholders like {name} are used, the system fails to strip or escape HTML and Markdown formatting provided by the user during registration. A remote, unauthenticated attacker can register with a crafted name to inject links or formatted text into emails sent to other users or administrators. While a strict HTML allow-list prevents Cross-Site Scripting (XSS), the flaw enables high-credibility phishing. The issue is fixed in versions 2025.7.3, 2025.8.2, and 2025.9.2.

## Affected products

- rami.io pretix >= 1.0.0, < 2025.7.3; >= 2025.8.0, < 2025.8.2; >= 2025.9.0, < 2025.9.2

## Identifiers

- CVE-2025-13742
- GHSA-2mm6-624x-fqrr
- PYSEC-2025-154

## Timeline

- 2025-11-27: disclosed
- 2025-11-27: advisory
- 2025-11-27: patched

## References

- [https://pretix.eu/about/en/blog/20251126-release-2025-9-1](https://pretix.eu/about/en/blog/20251126-release-2025-9-1)
- [https://github.com/pypa/advisory-database/tree/main/vulns/pretix/PYSEC-2025-154.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/pretix/PYSEC-2025-154.yaml)
- [https://pretix.eu/about/en/security](https://pretix.eu/about/en/security)
- [https://web.archive.org/web/20251129201933/https://pretix.eu/about/en/blog/20251127-release-2025-9-2](https://web.archive.org/web/20251129201933/https://pretix.eu/about/en/blog/20251127-release-2025-9-2)

## Related threats

- [pretix missing permission check in ticket layout API](https://junglewise.ai/threats/cve-2026-125744-our-api-endpoint-for-changing-ticket-layouts-did-not-properly)
- [Pretix payment status validation bypass in Adyen integration](https://junglewise.ai/threats/cve-2026-101275-our-payment-integration-with-adyen-did-not-properly-validate)
- [pretix improper validation of OpenID Connect response_type in SSO](https://junglewise.ai/threats/cve-2026-101274-when-pretix-is-used-as-the-identity-provider-in-a-single-sign-on)
- [pretix gift card ID enumeration and account credit increase](https://junglewise.ai/threats/cve-2026-101273-some-of-our-api-endpoints-allowed-to-create-order-payments)
- [pretix session validation bypass in API-created shredder exports](https://junglewise.ai/threats/cve-2026-101272-the-mechanism-binding-files-generated-during-a-shredding-process)