« Volver al listado

CVE-2026-2415

Estado: AnalizadaAlta (7.5)—

Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained two security-relevant bugs:

* It was possible to exfiltrate information about the pretix system through specially crafted placeholder names such as {{event.__init__.__code__.co_filename}}.

Leer descripción completaMostrar menos

This way, an attacker with the ability to control email templates (usually every user of the pretix backend) could retrieve sensitive information from the system configuration, including even database passwords or API keys. pretix does include mechanisms to prevent the usage of such malicious placeholders, however due to a mistake in the code, they were not fully effective for the email subject.

* Placeholders in subjects and plain text bodies of emails were wrongfully evaluated twice. Therefore, if the first evaluation of a placeholder again contains a placeholder, this second placeholder was rendered. This allows the rendering of placeholders controlled by the ticket buyer, and therefore the exploitation of the first issue as a ticket buyer. Luckily, the only buyer-controlled placeholder available in pretix by default (that is not validated in a way that prevents the issue) is {invoice_company}, which is very unusual (but not impossible) to be contained in an email subject template. In addition to broadening the attack surface of the first issue, this could theoretically also leak information about an order to one of the attendees within that order. However, we also consider this scenario very unlikely under typical conditions.

Out of caution, we recommend that you rotate all passwords and API keys contained in your pretix.cfg https://docs.pretix.eu/self-hosting/config/  file.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso remoto con PR:L (usuario autenticado) a servicio web. Exfiltración de datos sensibles (contraseñas, claves API) y credenciales del sistema a través de inyección SSTI en placeholders de email.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Password PoliciesVulnerability ScanningUser TrainingThreat Intelligence ProgramRestrict File and Directory PermissionsPrivileged Account Management

Tecnologías afectadas (1)

Pretix — Pretix

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-2415",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-2415",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-17T16:43:12.852157Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7.5,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:L/U:Red",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "providerUrgency": "RED",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "LOW",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6",
      "affectedData": [
        {
          "repo": "https://github.com/pretix/pretix",
          "vendor": "pretix",
          "product": "pretix",
          "versions": [
            {
              "status": "affected",
              "version": "4.16.0",
              "lessThan": "2025.9.0",
              "versionType": "python"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "2025.9.4",
                  "status": "unaffected"
                }
              ],
              "version": "2025.9.0",
              "lessThan": "2025.10.0",
              "versionType": "python"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "2025.10.2",
                  "status": "unaffected"
                }
              ],
              "version": "2025.10.0",
              "lessThan": "2026.1.0",
              "versionType": "python"
            },
            {
              "status": "affected",
              "version": "2026.1.0",
              "lessThan": "2026.1.1",
              "versionType": "python"
            }
          ],
          "packageName": "pretix",
          "collectionURL": "https://pypi.org/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-16T11:15:56.047",
  "references": [
    {
      "url": "https://pretix.eu/about/en/blog/20260216-release-2026-1-1/",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6",
      "description": [
        {
          "lang": "en",
          "value": "CWE-627"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name}\n is used in an email template, it will  be replaced with the buyer's \nname for the final email. This mechanism contained two security-relevant\n bugs:\n\n\n\n  *  \nIt was possible to exfiltrate information about the pretix system through specially crafted placeholder names such as {{event.__init__.__code__.co_filename}}.\n This way, an attacker with the ability to control email templates \n(usually every user of the pretix backend) could retrieve sensitive \ninformation from the system configuration, including even database \npasswords or API keys. pretix does include mechanisms to prevent the usage of such \nmalicious placeholders, however due to a mistake in the code, they were \nnot fully effective for the email subject.\n\n\n\n\n  *  \nPlaceholders in subjects and plain text bodies of emails were \nwrongfully evaluated twice. Therefore, if the first evaluation of a \nplaceholder again contains a placeholder, this second placeholder was \nrendered. This allows the rendering of placeholders controlled by the \nticket buyer, and therefore the exploitation of the first issue as a \nticket buyer. Luckily, the only buyer-controlled placeholder available \nin pretix by default (that is not validated in a way that prevents the \nissue) is {invoice_company}, which is very unusual (but not\n impossible) to be contained in an email subject template. In addition \nto broadening the attack surface of the first issue, this could \ntheoretically also leak information about an order to one of the \nattendees within that order. However, we also consider this scenario \nvery unlikely under typical conditions.\n\n\nOut of caution, we recommend that you rotate all passwords and API keys contained in your  pretix.cfg https://docs.pretix.eu/self-hosting/config/  file."
    },
    {
      "lang": "es",
      "value": "Los correos electrónicos enviados por pretix pueden utilizar marcadores de posición que se llenarán con datos del cliente. Por ejemplo, cuando {name} se usa en una plantilla de correo electrónico, será reemplazado con el nombre del comprador para el correo electrónico final. Este mecanismo contenía dos errores relevantes para la seguridad:\n\n*   Fue posible exfiltrar información sobre el sistema pretix a través de nombres de marcadores de posición especialmente diseñados, como {{event.__init__.__code__.co_filename}}. De esta manera, un atacante con la capacidad de controlar las plantillas de correo electrónico (generalmente cada usuario del backend de pretix) podría recuperar información sensible de la configuración del sistema, incluyendo incluso contraseñas de base de datos o claves API. pretix sí incluye mecanismos para prevenir el uso de tales marcadores de posición maliciosos, sin embargo, debido a un error en el código, no fueron completamente efectivos para el asunto del correo electrónico.\n\n*   Los marcadores de posición en los asuntos y cuerpos de texto plano de los correos electrónicos fueron evaluados erróneamente dos veces. Por lo tanto, si la primera evaluación de un marcador de posición contenía de nuevo un marcador de posición, este segundo marcador de posición era renderizado. Esto permite la renderización de marcadores de posición controlados por el comprador de entradas, y por lo tanto la explotación del primer problema como comprador de entradas. Afortunadamente, el único marcador de posición controlado por el comprador disponible en pretix por defecto (que no está validado de una manera que prevenga el problema) es {invoice_company}, lo cual es muy inusual (pero no imposible) que esté contenido en una plantilla de asunto de correo electrónico. Además de ampliar la superficie de ataque del primer problema, esto podría teóricamente también filtrar información sobre un pedido a uno de los asistentes dentro de ese pedido. Sin embargo, también consideramos este escenario muy improbable bajo condiciones típicas.\n\nPor precaución, recomendamos que rote todas las contraseñas y claves API contenidas en su archivo pretix.cfg https://docs.pretix.eu/self-hosting/config/."
    }
  ],
  "lastModified": "2026-06-17T10:30:55.160",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "676E56F1-348F-410C-BFDD-9124BD51E34B",
              "versionEndExcluding": "2026.1.1",
              "versionStartIncluding": "4.16.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "655498c3-6ec5-4f0b-aea6-853b334d05a6"
}