彙總 pretix 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
常見弱點模式包括 跨站腳本與輸入驗證問題，在 生產負載與軟體部署 使用場景中可能帶來 工作階段劫持與異常行為 等風險。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2026-5600 | A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective organizer. This allows an API consumer to access information for all other events under the same organizer, even those they should not have access to. These records contain information on the time and result of every ticket scan as well as the ID of the matched ticket. Example: { "id": 123, "successful": true, | 655498c3-6ec5-4f0b-aea6-853b334d05a6 | 5.5 | 0.26% | 2026-04-08 | 2026-06-17 |
| CVE-2026-2452 | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained a security-relevant bug: It was possible to exfiltrate information about the pretix system through specially crafted placeholder names such as {{event.__init__.__code__.co_filename}}. This way, an attacker with the ability to control email templates (usually every | 655498c3-6ec5-4f0b-aea6-853b334d05a6 | 7.5 | 0.26% | 2026-02-16 | 2026-06-17 |
| CVE-2026-2451 | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained a security-relevant bug: It was possible to exfiltrate information about the pretix system through specially crafted placeholder names such as {{event.__init__.__code__.co_filename}}. This way, an attacker with the ability to control email templates (usually every | 655498c3-6ec5-4f0b-aea6-853b334d05a6 | 7.5 | 0.26% | 2026-02-16 | 2026-06-17 |
| CVE-2026-2415 | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained two security-relevant bugs: * It was possible to exfiltrate information about the pretix system through specially crafted placeholder names such as {{event.__init__.__code__.co_filename}}. This way, an attacker with the ability to control email templates (u | 655498c3-6ec5-4f0b-aea6-853b334d05a6 | 7.5 | 0.24% | 2026-02-16 | 2026-06-17 |
| CVE-2025-13742 | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown formatting, this was rendered as HTML in the resulting email. This way, a user could inject links or other formatted text through a maliciously formatted name. Since pretix applies a strict allow list approach to allowed HTML tags, this cou | 655498c3-6ec5-4f0b-aea6-853b334d05a6 | 2.4 | 0.15% | 2025-11-27 | 2026-06-17 |
| CVE-2024-8113 | Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However, combined with a CSP bypass (which is not currently known) the vulnerability could be used to impersonate other organizers or staff users. | 655498c3-6ec5-4f0b-aea6-853b334d05a6 | 7.2 | 0.30% | 2024-08-23 | 2026-06-17 |
| CVE-2024-27447 | pretix before 2024.1.1 mishandles file validation. | [email protected] | 9.8 | 0.82% | 2024-02-26 | 2026-06-17 |