TI-2026-30025 Aliases CVE-2026-41426 GHSA-jm8c-9f3j-4378

pretalx: Email injection via unescaped user-controlled placeholders in pretalx mail templates

LOW 26CWE-116Published 2026-04-24 · Updated 2026-04-25

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

pretalx is a conference planning tool. Prior to 2026.1.0, an unauthenticated attacker can send arbitrary HTML-rendered emails from a pretalx instance's configured sender address by embedding malformed HTML or markdown link syntax in a user-controlled template placeholder such as the account display name. The most direct vector is the password-reset flow: the attacker registers an account with a malicious name, enters the victim's email address, and triggers a password reset. The resulting email is delivered from the event's legitimate sender address and passes SPF/DKIM/DMARC validation, making it a ready-made phishing vector. This vulnerability is fixed in 2026.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00154 4th percentileScored 2026-11-07

Fix Fixed pretalx (pretalx): 2026.1.0pretalx (PyPI): 2026.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pretalx	pretalx	before 2026.1.0	2026.1.0	Patch available	CNA
—	pretalx (PyPI)	before 2026.1.0	2026.1.0	Patch available	GHSA-jm8c-9f3j-4378

pretalx Vendorpretalx Affected before 2026.1.0 Fixed in 2026.1.0 Patch available CNA
pretalx (PyPI) Vendor— Affected before 2026.1.0 Fixed in 2026.1.0 Patch available GHSA-jm8c-9f3j-4378

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pretalx:pretalx::::::::	before 2026.1.0	Vulnerable	pretalx

cpe:2.3:a:pretalx:pretalx:*:*:*:*:*:*:*:* Versions before 2026.1.0 Vulnerable ·pretalx

Remediation

Fix · CNA pretalx (pretalx) Fixed in 2026.1.0
Fix · GHSA-jm8c-9f3j-4378 pretalx (PyPI) Fixed in 2026.1.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-41426
2026-10-03 Alias added: GHSA-jm8c-9f3j-4378

References

Advisory 2

Other 2

TI-2023-13000 pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). CVSS 3.1MEDIUM 6.5
TI-2023-12999 pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). CVSS 3.1MEDIUM 4.3
TI-2026-29850 pretalx: Stored cross-site scripting in organiser search typeahead CVSS 3.1HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences