CVE-2026-2452
Severity CVSS v4.0:
HIGH
Type:
Unavailable / Other
Publication date:
16/02/2026
Last modified:
12/03/2026
Description
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name}<br />
is used in an email template, it will be replaced with the buyer&#39;s <br />
name for the final email. This mechanism contained a security-relevant bug:<br />
<br />
It was possible to exfiltrate information about the pretix system through specially crafted placeholder names such as {{event.__init__.__code__.co_filename}}.<br />
This way, an attacker with the ability to control email templates <br />
(usually every user of the pretix backend) could retrieve sensitive <br />
information from the system configuration, including even database <br />
passwords or API keys. pretix does include mechanisms to prevent the usage of such <br />
malicious placeholders, however due to a mistake in the code, they were <br />
not fully effective for this plugin.<br />
<br />
Out of caution, we recommend that you rotate all passwords and API keys contained in your pretix.cfg https://docs.pretix.eu/self-hosting/config/ file.
Impact
Base Score 4.0
7.50
Severity 4.0
HIGH
Base Score 3.x
6.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:pretix:newsletters:*:*:*:*:*:pretix:*:* | 1.6.3 (excluding) | |
| cpe:2.3:a:pretix:newsletters:2.0.0:*:*:*:*:pretix:*:* | ||
| cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:* | 4.16.0 (including) | 2026.1.1 (excluding) |
To consult the complete list of CPE names with products and versions, see this page