Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-57532

Malicious HTML content contained in the layout specification of a PDF

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
rami.io

Description

Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of another backend user. Due to requirements of the PDF rendering and editing libraries used, this is one of the few pages in our backend that do not have a strong Content-Security-Policy that would render this capability useless for most scenarios.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

pretix pretix

Default version status: unaffected

  • 0 to < 2026.3.4affected
  • 2026.4.0 to < 2026.4.4affected
  • 2026.5.0 to < 2026.5.2affected

References