Executive brief
pretix is an open-source ticketing and event management platform. A security flaw allowed attackers to inject malicious code into the email address field of an order, which would then be executed when a user viewed the ticket confirmation page. This could potentially lead to unauthorized actions being performed in the user's browser or the theft of session information, particularly if security headers have been weakened by third-party tracking plugins.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in pretix due to improper neutralization of input in the email address field of an order (CWE-80). The application fails to sanitize this input before displaying it on the individual ticket confirmation pages. An unauthenticated attacker can provide a malicious payload during the checkout process. While pretix generally employs a strong Content Security Policy (CSP), the vendor notes that this specific page's CSP may be weakened by certain tracking plugins, increasing the risk of script execution. The vulnerability is fixed in versions 2026.3.4, 2026.4.4, and 2026.5.2.
Affected products
- rami.io pretix < 2026.3.4, 2026.4.0 to < 2026.4.4, 2026.5.0 to < 2026.5.2
Timeline
- 2026-06-25: disclosed: Discovered internally by the vendor.
- 2026-06-25: patched
- 2026-06-25: advisory