CVE Feed

    Dashboard / CVE / CVE-2026-57532

    CVE-2026-57532

    Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of another backend user. Due to requirements of the PDF rendering and editing libraries used, this is one of the few pages in our backend that do not have a strong Content-Security-Policy that would render this capability useless for most scenarios.

    Published:Jun 25, 2026
    Last Modified:Jun 25, 2026
    EPS:Jun 25, 2026
    EPSS Score:
    CVSS Score:8.8

    Affected Products

    Vendor
    Pretix
    Product
    Pretix

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-18028 (CVSS 2.3) — The "quick setup" view presented to users after they first create an event allows to set up the most critical…
    CVE-2026-13602 (CVSS 7.7) — We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any us…
    CVE-2026-57533 (CVSS 2.1) — Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occ…
    CVE-2026-57535 (CVSS 2.1) — Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. I…
    CVE-2026-13225 (CVSS 5.3) — Malicious HTML content could be injected into the email address of an order, which pretix showed without sani…
    CVE-2026-11764 (CVSS 3.6) — When creating an export of all reusable media, the secrets of connected gift cards were included in the expor…
    CVE-2026-9712 (CVSS 3.8) — When creating an export through the pretix API, API clients are returned an UUID value for their export job (…
    CVE-2026-5600 (CVSS 5.5) — A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific eve…
    CVE-2026-2452 (CVSS 7.5) — Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name…
    CVE-2026-2451 (CVSS 7.5) — Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High