PT-2026-27251 · Latex+4 · Latex+4

Daw1012345 + 1 · Published 2026-03-23 · Updated 2026-03-24 · CVE-2026-33046

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Indico versions prior to 3.3.12

Description Indico is an event management system that utilizes Flask-Multipass, a multi-backend authentication system for Flask. Due to vulnerabilities in TeXLive and obscure LaTeX syntax that circumvented Indico's LaTeX sanitizer, specially crafted LaTeX snippets could be used to read local files or execute code with the privileges of the user running Indico on the server. This issue does not apply if server-side LaTeX rendering is not in use, meaning the XELATEX PATH setting is not configured in indico.conf.

Recommendations Update to Indico version 3.3.12 as soon as possible. Enable the containerized LaTeX renderer using podman to isolate it from the rest of the system. Remove the XELATEX PATH setting from indico.conf or set it to None and restart the indico-uwsgi and indico-celery services to disable LaTeX functionality.

Exploit

Fix

RCE

Path traversal

OS Command Injection

Weakness Enumeration

CWE-22

CWE-78

Related Identifiers

CVE-2026-33046

GHSA-RM2Q-F7JV-3CFP

Affected Products

Flask-Multipass

Indico

Latex

Tex Live

Podman

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33046.json · Exploit
• https://github.com/indico/indico/commit/5f24d23ce9c4b0e4b68b3d0b58987a948fc57c8a · Patch
• https://github.com/indico/indico/commit/0adb70f0ed66e129361d447868f5f3eb90dc5e96 · Patch
• https://github.com/indico/indico/commit/fb169ced710c30cf792ce4b9f48688db0633cfd8 · Patch
• https://github.com/indico/indico/security/advisories/GHSA-rm2q-f7jv-3cfp · Vendor Advisory
• https://github.com/indico/indico/commit/1dbb12525b3de14229bf4d1ae192988068f975f6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33046 · Security Note
• https://osv.dev/vulnerability/GHSA-rm2q-f7jv-3cfp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33046 · Vendor Advisory
• https://github.com/indico/indico · Note
• https://github.com/indico/indico/releases/tag/v3.3.12 · Note
• https://twitter.com/VulmonFeeds/status/2036244854166990864 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1s2f6l7/resumen_diario_de_vulnerabilidades_24032026 · Reddit Post
• https://twitter.com/cyberbivash/status/2036222549797855314 · Twitter Post