{"id":"CVE-2026-57535","state":"PUBLISHED","title":"Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src","description":"Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src\n attribute of these images pointed to an URL, the PDF rendering engine \nwould download the image from that place and display it, thereby leaking\n information about the rendering server and possibly creating an SSRF \nvector in the local network.","publishedAt":"2026-06-25T14:29:18.531Z","updatedAt":"2026-06-25T15:10:48.584Z","severity":{"score":2.1,"label":"Low","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","source":"rami.io"},"assigner":"rami.io","products":["pretix pretix"],"affected":[{"vendor":"pretix","product":"pretix","packageName":"pretix","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2026.3.4","versionType":"python"},{"version":"2026.4.0","status":"affected","lessThan":"2026.4.4","versionType":"python"},{"version":"2026.5.0","status":"affected","lessThan":"2026.5.2","versionType":"python"}],"collectionURL":"https://pypi.python.org","repo":"https://github.com/pretix/pretix"}],"references":["https://pretix.eu/about/en/blog/20260625-release-2026-5-2/"],"weaknesses":["CWE-80"],"ingestedAt":"2026-10-29T20:12:24.861Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/57xxx/CVE-2026-57535.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-57535","state":"PUBLISHED","datePublished":"2026-06-25T14:29:18.531Z","dateUpdated":"2026-06-25T15:10:48.584Z","assignerShortName":"rami.io","assignerOrgId":"655498c3-6ec5-4f0b-aea6-853b334d05a6","dateReserved":"2026-06-24T15:59:32.628Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src\n attribute of these images pointed to an URL, the PDF rendering engine \nwould download the image from that place and display it, thereby leaking\n information about the rendering server and possibly creating an SSRF \nvector in the local network."}],"affected":[{"vendor":"pretix","product":"pretix","packageName":"pretix","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2026.3.4","versionType":"python"},{"version":"2026.4.0","status":"affected","lessThan":"2026.4.4","versionType":"python"},{"version":"2026.5.0","status":"affected","lessThan":"2026.5.2","versionType":"python"}],"collectionURL":"https://pypi.python.org","repo":"https://github.com/pretix/pretix"}],"references":[{"url":"https://pretix.eu/about/en/blog/20260625-release-2026-5-2/"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","subConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","subIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"LOW","baseScore":2.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-80","lang":"en","description":"CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS)","type":"CWE"}]}],"providerMetadata":{"shortName":"rami.io","orgId":"655498c3-6ec5-4f0b-aea6-853b334d05a6","dateUpdated":"2026-06-25T14:32:51.282Z"},"impacts":[{"capecId":"CAPEC-664","descriptions":[{"lang":"en","value":"CAPEC-664 Server Side Request Forgery"}]}],"credits":[{"lang":"en","value":"Rokkam Vamshi","type":"finder"}],"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-25T15:10:42.511872Z","id":"CVE-2026-57535","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-25T15:10:48.584Z"}}]}}}