CVE-2026-57533

LOW

Pretix - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Title source: rule

Description

Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Policy, this can mainly be used for phishing purposes.

References (1)

Core 1

Core References

https://pretix.eu/about/en/blog/20260625-release-2026-5-2/

Scores

CVSS v4 2.1

EPSS 0.0025

EPSS Percentile 16.2%

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-80

Status published

Products (3)

pretix/pretix < 2026.3.4

pretix/pretix 2026.4.0 - 2026.4.4

pretix/pretix 2026.5.0 - 2026.5.2

Published Jun 25, 2026

Tracked Since Jun 25, 2026