Vulnerabilities

TI-2026-30025 CVE-2026-41426 · GHSA-jm8c-9f3j-4378

pretalx: Email injection via unescaped user-controlled placeholders in pretalx mail templates

LOW 26

pretalx is a conference planning tool.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00154 Published 2026-04-24 Fixed in 2026.1.0 CWE-116

TI-2026-29850 CVE-2026-41241 · GHSA-cjcx-jfp2-f7m2

LOW 39

pretalx is a conference planning tool.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00166 Published 2026-04-23 Fixed in 2026.1.0 CWE-79

TI-2023-13000 CVE-2023-28459 · GHSA-wh3w-jcc7-mhmf

MEDIUM 62

pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.06648 Published 2023-04-20 Fixed in 2.3.2 CWE-22

TI-2023-12999 CVE-2023-28458 · GHSA-23fx-92m6-4f2g

MEDIUM 53

pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.03429 Published 2023-04-20 Fixed in 2.3.2 CWE-22