# CVE-2026-33046: Indico discloses local files resulting in Remote Code Execution through LaTeX injection

Source: https://junglewise.ai/threats/cve-2026-33046-indico-discloses-local-files-resulting-in-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-23  
License: CC BY 4.0 with a link back

CVE-2026-33046 · Severity: medium · CVSS 4 · Published 2026-03-23

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.12, due to vulnerabilities in TeXLive and obscure LaTeX syntax that allowed circumventing Indico's LaTeX sanitizer, it is possible to use specially-crafted LaTeX snippets which can read local files or execute code with the privileges of the user running Indico on the server. Note that if server-side LaTeX rendering is not in use (ie `XELATEX_PATH` was not set in `indico.conf`), this vulnerability does not apply. It is recommended to update to Indico 3.3.12 as soon as possible. It is also strongly recommended to enable the containerized LaTeX renderer (using `podman`), which isolates it from the rest of the system. As a workaround, remove the `XELATEX_PATH` setting from `indico.conf` (or comment it out or set it to `None`) and restart the `indico-uwsgi` and `indico-celery` services to disable LaTeX functionality.

Technologies: [indico (PyPI)](https://junglewise.ai/threats/technologies/indico). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-33046 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33046 being exploited in the wild.

**How severe is CVE-2026-33046?** Medium severity, with a CVSS score of 4, published 23 March 2026.

**Which products and versions are affected?** indico (PyPI) ECOSYSTEM:introduced=0,fixed=3.3.12.

**Is there a fix for CVE-2026-33046?** Yes. indico (PyPI): upgrade to 3.3.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-33046?** Check whether you run indico (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- indico (PyPI): upgrade to 3.3.12 or later

  ```sh
  pip install "indico>=3.3.12"
  ```


## Affected products

- indico (PyPI) ECOSYSTEM:introduced=0,fixed=3.3.12

## Identifiers

- CVE-2026-33046
- GHSA-rm2q-f7jv-3cfp
- PYSEC-2026-2184

## Related threats

- [Indico Cross-Site-Scripting in minutes editor](https://junglewise.ai/threats/cve-2026-107397-indico-cross-site-scripting-in-minutes-editor)
- [Indico cross-site scripting in link fields](https://junglewise.ai/threats/cve-2026-107396-indico-cross-site-scripting-in-link-fields)
- [Indico missing access check in legacy session export API](https://junglewise.ai/threats/cve-2026-107395-indico-missing-access-check-in-legacy-session-export-api)
- [Indico incomplete SSRF check in URL validation](https://junglewise.ai/threats/cve-2026-107394-indico-incomplete-server-side-request-forgery-ssrf-check)
- [PYSEC-2026-1461 - Indico vulnerable to Cross-Site Scripting via LaTeX math code](https://junglewise.ai/threats/cve-2025-59035-indico-vulnerable-to-cross-site-scripting-via-latex-math-code)