CVE-2026-2451
Severity CVSS v4.0:
HIGH
Type:
Unavailable / Other
Publication date:
16/02/2026
Last modified:
18/02/2026
Description
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name}<br />
is used in an email template, it will be replaced with the buyer&#39;s <br />
name for the final email. This mechanism contained a security-relevant bug:<br />
<br />
It was possible to exfiltrate information about the pretix system through specially crafted placeholder names such as {{event.__init__.__code__.co_filename}}.<br />
This way, an attacker with the ability to control email templates <br />
(usually every user of the pretix backend) could retrieve sensitive <br />
information from the system configuration, including even database <br />
passwords or API keys. pretix does include mechanisms to prevent the usage of such <br />
malicious placeholders, however due to a mistake in the code, they were <br />
not fully effective for this plugin.<br />
<br />
Out of caution, we recommend that you rotate all passwords and API keys contained in your pretix.cfg file.