Information Disclosure Vulnerability in pretix by Pretix

CVE-2026-2452

What is CVE-2026-2452?

The pretix system has a vulnerability that allows an attacker to exploit the email template placeholder functionality to exfiltrate sensitive data. Specifically, when placeholders like {{event.init.code.co_filename}} are crafted, they can reveal critical system configuration information, including database passwords and API keys, accessible to users with backend email template control. Although pretix incorporates measures to mitigate this risk, a coding error has led to inadequate protection. Users are strongly advised to rotate any exposed credentials found in their pretix.cfg file to enhance security.

References