Vulnerabilities

Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser.

Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs.

Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags.

Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.