Executive brief
pretix-pages is a plugin for the pretix ticketing system that allows organizers to create custom informational pages. A vulnerability exists where an attacker with high-level administrative privileges can inject malicious HTML into these pages. While the impact is limited by security headers that prevent most script execution, it could still be used for phishing or altering the appearance of the site.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the pretix-pages plugin for pretix due to improper neutralization of script-related HTML tags (CWE-80). An attacker with high privileges (PR:H) can inject malicious HTML into the content of a page. The impact is mitigated by a strong Content-Security-Policy (CSP) on the affected pages, which limits the execution of unauthorized scripts but may still allow for HTML injection or phishing. The vulnerability is fixed in version 1.6.4 of the plugin.
Affected products
- pretix pretix-pages < 1.6.4
Timeline
- 2026-06-25: disclosed: Discovered internally by rami.io
- 2026-06-25: advisory
- 2026-06-25: patched