HTML Injection Vulnerability in PDF Editing Tool from Pretix

CVE-2026-57532

What is CVE-2026-57532?

A vulnerability in the PDF editing tool from Pretix allows malicious HTML content to be executed when the PDF editor is accessed in a browser. This issue arises because the layout specifications for PDF tickets or badges can include harmful HTML, permitting one backend user to inject JavaScript code into another backend user's browser context. The weakness is compounded by the lack of a robust Content-Security-Policy in this specific area of the Pretix backend, making it easier for such an attack to succeed. Users are urged to be vigilant and follow best security practices to mitigate risks associated with this vulnerability.

References