CVE-2026-41426: pretalx email injection in mail templates via unescaped placeholders

Executive brief

pretalx, a conference management tool, is vulnerable to a flaw that allows attackers to send deceptive emails from the official system address. By using specially crafted names or profile information, an attacker can trick the system into sending phishing emails that appear legitimate to recipients. This could be used to steal user credentials or spread misinformation while bypassing standard email security filters.

Technical details

A vulnerability in pretalx mail templates arises from improper neutralization of user-controlled placeholders (CWE-79, CWE-116). An unauthenticated attacker can inject malformed HTML or Markdown syntax into fields like account display names, speaker biographies, or proposal titles. When these fields are interpolated into system-generated emails (such as password reset or notification emails), the injected content is rendered, allowing the attacker to control the email's body. Because these emails originate from the legitimate configured sender and pass SPF/DKIM/DMARC checks, they serve as a highly effective phishing vector. The issue is fixed in version 2026.1.0.

Affected products

• pretalx pretalx < 2026.1.0

Timeline

• 2026-04-17: patched: Fix released in version 2026.1.0
• 2026-04-18: advisory: GitHub Advisory published

References

• https://api.github.com/users/markfijneman
• https://github.com/markfijneman
• https://api.github.com/users/markfijneman/gists%7B/gist_id%7D
• https://api.github.com/users/markfijneman/repos
• https://avatars.githubusercontent.com/u/48481393?v=4
• https://api.github.com/users/markfijneman/events%7B/privacy%7D