Email Manipulation Vulnerability in Pretix Product by Pretix

CVE-2025-13742

What is CVE-2025-13742?

The Pretix product exposes a vulnerability that allows malicious formatting of attendee names to be rendered as HTML in emails. This vulnerability can manipulate email content dynamically, leading users to perceive a higher level of credibility in malicious links or formatted texts. While XSS attacks are not feasible due to a strict allow list on HTML tags, this manipulation poses a risk for phishing attacks, where users may be lured into clicking deceptive links that appear trustworthy.

References