pretix Stored XSS and SSRF Vulnerabilities (CVE-2026-57532) Advisory

Vulnerability Overview 1. Stored XSS in PDF layout editor [HIGH] - CVE ID: CVE-2026-57532 - Description: Malicious HTML content can be injected into the layout specifications for PDF tickets or badges and executed when the PDF editor is opened in a browser. - Severity: High 2. Reflected XSS in redirection page [LOW] - CVE ID: CVE-2026-57533 - Description: Malicious HTML content can be injected into the redirection page for phishing purposes. - Severity: Low 3. SSRF through HTML injection in PDF rendering [LOW] - CVE ID: CVE-2026-57535 - Description: Content injected into the PDF rendering context may contain tags pointing to URLs, causing the PDF rendering engine to download images and leak information. - Severity: Low 4. Stored XSS in ticket confirmation page [MEDIUM] - CVE ID: CVE-2026-13225 - Description: Malicious HTML content can be injected into the order's email address, which is displayed in the pre-text without sanitization. - Severity: Medium 5. Stored XSS in pretix-pages [LOW] - CVE ID: CVE-2026-57534 - Description: Malicious HTML content can be injected into the content of the plugin. - Severity: Low 6. Insufficient validation of payment status in pretix-mollie [MEDIUM] - CVE ID: CVE-2026-57536 - Description: The payment integration does not correctly validate the payment status response, potentially allowing multiple valid tickets to be issued for a single payment. - Severity: Medium 7. Insufficient validation of payment status in pretix-opppwa [MEDIUM] - CVE ID: CVE-2026-13222 - Description: The payment integration does not correctly validate the payment status response, potentially allowing multiple valid tickets to be issued for a single payment. - Severity: Medium 8. Insufficient validation of payment status in pretix-computop [MEDIUM] - CVE ID: CVE-2026-13223 - Description: The payment integration does not correctly validate the payment status response, potentially allowing multiple valid tickets to be issued for a single payment. - Severity: Medium 9. Stored XSS in pretix-digital [LOW] - CVE ID: CVE-2026-13314 - Description: Malicious HTML content can be injected into the content of the plugin. - Severity: Low Affected Versions All currently supported versions (except for the fixed versions listed below) are affected. Fixed Versions: - pretix 2026.5.2, 2026.4.4, 2026.3.4 - pretix-pages 1.6.4 - pretix-mollie 2.5.6 - pretix-opppwa 1.4.3 - pretix-computop 1.3.2 - pretix-digital 1.6.5 (Enterprise plugin) Remediation Upgrade Versions: Upgrade to the fixed versions listed above. API Change: The return type of the signal has changed from to . Plugin Deprecation: The plugin has been deprecated, but version 1.1.2 was released as the final fix. POC Code or Exploit Code No specific POC code or exploit code is provided in the page.

Goal Reached Thanks to every supporter — we hit 100%!

pretix Stored XSS and SSRF Vulnerabilities (CVE-2026-57532) Advisory