CVE-2026-57532: high-severity vulnerability in pretix
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.4%
Malicious HTML content contained in the layout specification of a PDF
ticket or badge layout was executed when the PDF editor is opened in the
browser. This could allow one backend user to inject JavaScript into
the browser context of another backend user. Due to requirements of the
PDF rendering and editing libraries used, this is one of the few pages
in our backend that do not have a strong Content-Security-Policy that
would render this capability useless for most scenarios.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
pretix · pretixRelated CVEs — pretix
In the same product, most dangerous first.
CVE-2026-13225MEDIUMStored XSS in ticket confirmation pageEPSS 0.4%CVE-2026-57535LOWCVE-2026-57535EPSS 0.4%CVE-2026-13602HIGHSession takeover vulnerabilityEPSS 0.4%CVE-2026-101274MEDIUMCVE-2026-101274EPSS 0.4%CVE-2026-101272LOWIncorrect session validation for API-created shredder exportsEPSS 0.3%CVE-2026-101273MEDIUMGiftcard enumerationEPSS 0.3%