Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-57532 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of another backend user. Due to requirements of the PDF rendering and editing libraries used, this is one of the few pages in our backend that do not have a strong Content-Security-Policy that would render this capability useless for most scenarios.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:4.4 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://pretix.eu/about/en/blog/20260625-release-2026-5-2/	rami.io	AdvisoryBundleRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-80	Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)	rami.io

Affected Products

Product	Versions
pretix	>= 2026, < 2026.5.2 >= 2026, < 2026.4.4 >= 2026, < 2026.3.4
CPE cpe:2.3:a:pretix:pretix:::::::: Remediation Upgrade: 2026.5.2moderate efforthttps://pypi.python.org/pypi/pretix/2026.5.2 Upgrade: 2026.4.4moderate efforthttps://pypi.python.org/pypi/pretix/2026.4.4 Upgrade: 2026.3.4moderate efforthttps://pypi.python.org/pypi/pretix/2026.3.4

Change History

2 change records found show changes

Date	Action	Recorded By
Jun 25, 2026	CVE Modified	CISA-ADP
Jun 25, 2026	New CVE Received	rami.io