TI-2026-41417 Aliases CVE-2026-57533 GHSA-f658-prxw-vx8p

Cross-site scripting in pretix

LOW 11CWE-80Published 2026-06-25 · Updated 2026-06-25

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: High
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-80.

Summary

Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Policy, this can mainly be used for phishing purposes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00295 22nd percentileScored 2026-11-07

Fix Fixed pretix (pretix): 2026.3.4, 2026.4.4, 2026.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pretix	pretix	before 2026.3.4; 2026.4.0 to before 2026.4.4; 2026.5.0 to before 2026.5.2	2026.3.4, 2026.4.4, 2026.5.2	Patch available	CNA

pretix Vendorpretix Affected before 2026.3.4; 2026.4.0 to before 2026.4.4; 2026.5.0 to before 2026.5.2 Fixed in 2026.3.4, 2026.4.4, 2026.5.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:pretix:pretix::::::::	—	—	pretix

cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:* Versions — — ·pretix

Remediation

Fix · CNA pretix (pretix) Fixed in 2026.3.4, 2026.4.4, 2026.5.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-06-25
pretix 2026.3.4, 2026.4.4, 2026.5.2
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2026-41416 Cross-site scripting in pretixPriority MEDIUM 40
- TI-2026-11229 Stored XSS in ticket confirmation pagePriority LOW 24
- TI-2026-41419 Cross-site scripting in pretixPriority LOW 11
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-57533
2026-10-03 Alias added: GHSA-f658-prxw-vx8p

References

Other 1

https://pretix.eu/about/en/blog/20260625-release-2026-5-2/

TI-2024-18268 pretix before 2024.1.1 mishandles file validation. CVSS 3.1CRITICAL 9.8
TI-2026-11524 SSRF with API key leak in pretix-oppwa CVSS 4.0CRITICAL 9.0
TI-2026-41416 Cross-site scripting in pretix CVSS 4.0HIGH 8.8
TI-2026-11523 Session takeover vulnerability CVSS 4.0HIGH 7.7
TI-2026-02082 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
TI-2026-02081 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5

See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences