CVE-2026-57535

LOW

Pretix - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Title source: rule

Description

Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these images pointed to an URL, the PDF rendering engine would download the image from that place and display it, thereby leaking information about the rendering server and possibly creating an SSRF vector in the local network.

References (1)

Core 1

Core References

https://pretix.eu/about/en/blog/20260625-release-2026-5-2/

Scores

CVSS v4 2.1

EPSS 0.0031

EPSS Percentile 23.1%

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-80

Status published

Products (3)

pretix/pretix < 2026.3.4

pretix/pretix 2026.4.0 - 2026.4.4

pretix/pretix 2026.5.0 - 2026.5.2

Published Jun 25, 2026

Tracked Since Jun 25, 2026