CVE-2026-2452
Gravedad CVSS v4.0:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
16/02/2026
Última modificación:
16/02/2026
Descripción
*** Pendiente de traducción *** Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name}<br />
is used in an email template, it will be replaced with the buyer&#39;s <br />
name for the final email. This mechanism contained a security-relevant bug:<br />
<br />
It was possible to exfiltrate information about the pretix system through specially crafted placeholder names such as {{event.__init__.__code__.co_filename}}.<br />
This way, an attacker with the ability to control email templates <br />
(usually every user of the pretix backend) could retrieve sensitive <br />
information from the system configuration, including even database <br />
passwords or API keys. pretix does include mechanisms to prevent the usage of such <br />
malicious placeholders, however due to a mistake in the code, they were <br />
not fully effective for this plugin.<br />
<br />
Out of caution, we recommend that you rotate all passwords and API keys contained in your pretix.cfg https://docs.pretix.eu/self-hosting/config/ file.