CVE-2026-2415

Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name}<br /> is used in an email template, it will be replaced with the buyer&amp;#39;s <br /> name for the final email. This mechanism contained two security-relevant<br /> bugs:<br /> <br /> <br /> <br /> * <br /> It was possible to exfiltrate information about the pretix system through specially crafted placeholder names such as {{event.__init__.__code__.co_filename}}.<br /> This way, an attacker with the ability to control email templates <br /> (usually every user of the pretix backend) could retrieve sensitive <br /> information from the system configuration, including even database <br /> passwords or API keys. pretix does include mechanisms to prevent the usage of such <br /> malicious placeholders, however due to a mistake in the code, they were <br /> not fully effective for the email subject.<br /> <br /> <br /> <br /> <br /> * <br /> Placeholders in subjects and plain text bodies of emails were <br /> wrongfully evaluated twice. Therefore, if the first evaluation of a <br /> placeholder again contains a placeholder, this second placeholder was <br /> rendered. This allows the rendering of placeholders controlled by the <br /> ticket buyer, and therefore the exploitation of the first issue as a <br /> ticket buyer. Luckily, the only buyer-controlled placeholder available <br /> in pretix by default (that is not validated in a way that prevents the <br /> issue) is {invoice_company}, which is very unusual (but not<br /> impossible) to be contained in an email subject template. In addition <br /> to broadening the attack surface of the first issue, this could <br /> theoretically also leak information about an order to one of the <br /> attendees within that order. However, we also consider this scenario <br /> very unlikely under typical conditions.<br /> <br /> <br /> Out of caution, we recommend that you rotate all passwords and API keys contained in your pretix.cfg https://docs.pretix.eu/self-hosting/config/  file.