PT-2025-48262 · Pretix · Pretix

Jan Roring · Published 2025-11-27 · Updated 2025-12-30 · CVE-2025-13742

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions pretix (affected versions not specified)

Description The software allows the use of placeholders in email templates that are populated with customer data, such as the attendee's name. If a customer's name contains HTML or Markdown formatting, this formatting is rendered in the final email. While a strict allow list approach prevents cross-site scripting (XSS) or similar attacks, this can be exploited to manipulate emails, potentially enabling phishing attacks by making user-provided content appear trustworthy. The issue involves the rendering of potentially malicious formatting within the name placeholder when constructing emails.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2025-13742

PYSEC-2025-154

Affected Products

Pretix

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-13742 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13742 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-154 · Vendor Advisory
• https://pretix.eu/about/en/blog/20251126-release-2025-9-1 · Vendor Advisory
• https://twitter.com/CVEnew/status/1994006206835470810 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1994018940649885849 · Twitter Post
• https://t.me/CVEtracker/38384 · Telegram Post
• https://t.me/cveNotify/147147 · Telegram Post
• https://t.me/cveNotify/144184 · Telegram Post