# CVE-2026-57533: rami.io pretix reflected XSS in redirection page

Source: https://junglewise.ai/threats/cve-2026-57533-rami-io-pretix-reflected-xss-in-redirection-page  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-57533 · Severity: info · CVSS 2.1 · Published 2026-06-25

pretix is an open-source ticket sales and event management platform. A security flaw exists where an attacker can inject malicious content into the page shown when a user is being redirected to an external site. While technical safeguards limit the ability to run malicious code, this vulnerability can be used to create convincing phishing pages to trick users into revealing sensitive information.

Technologies: [Rami.Io Pretix](https://junglewise.ai/threats/technologies/pretix). Vendors: [Rami.Io](https://junglewise.ai/threats/vendors/rami-io).

## Quick answers

**Is CVE-2026-57533 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57533 being exploited in the wild.

**How severe is CVE-2026-57533?** Informational severity, with a CVSS score of 2.1, published 25 June 2026.

**Which products and versions are affected?** Rami.Io Pretix < 2026.3.4, 2026.4.0 to < 2026.4.4, 2026.5.0 to < 2026.5.2.

**Is there a fix for CVE-2026-57533?** A patch was published on 2026-06-25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57533 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-57533?** Check whether you run Rami.Io Pretix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the redirection component of pretix. The application fails to properly sanitize input when displaying a warning page for untrusted external redirections, allowing an attacker to inject malicious HTML content. Although the impact of script execution is mitigated by a strong Content-Security-Policy (CSP), the vulnerability can still be leveraged for phishing or UI redressing. The attack requires a user to interact with a specially crafted link. The issue is fixed in versions 2026.3.4, 2026.4.4, and 2026.5.2.

## Affected products

- rami.io pretix < 2026.3.4, 2026.4.0 to < 2026.4.4, 2026.5.0 to < 2026.5.2

## Timeline

- 2026-06-25: disclosed
- 2026-06-25: patched
- 2026-06-25: advisory

## References

- [https://pypi.python.org/](https://pypi.python.org/)
- [https://pretix.eu/about/en/blog/20260625-release-2026-5-2/](https://pretix.eu/about/en/blog/20260625-release-2026-5-2/)

## Related threats

- [rami.io pretix privilege escalation via session parameter injection](https://junglewise.ai/threats/cve-2026-13602-rami-io-pretix-privilege-escalation-via-session-parameter)
- [rami.io pretix stored XSS in ticket confirmation page](https://junglewise.ai/threats/cve-2026-13225-rami-io-pretix-stored-xss-in-ticket-confirmation-page)
- [rami.io pretix improper handling of permissions in reusable media export](https://junglewise.ai/threats/cve-2026-11764-rami-io-pretix-improper-handling-of-permissions-in-reusable-media)
- [rami.io pretix authorization bypass in API export endpoint](https://junglewise.ai/threats/cve-2026-9712-rami-io-pretix-authorization-bypass-in-api-export-endpoint)
- [rami.io pretix email content injection via attendee names](https://junglewise.ai/threats/cve-2025-13742-rami-io-pretix-email-content-injection-via-attendee-names)