CVE-2026-57532

HighCVSS 8.8/10Last modified Jun 25, 2026

Description

Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of another backend user. Due to requirements of the PDF rendering and editing libraries used, this is one of the few pages in our backend that do not have a strong Content-Security-Policy that would render this capability useless for most scenarios.

Metrics

CVSS 4.0 8.8/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-80

Affected software

Vendor	Product	Versions
pretix	pretix	< 2026.3.4; >= 2026.4.0, < 2026.4.4; >= 2026.5.0, < 2026.5.2

References

https://pretix.eu/about/en/blog/20260625-release-2026-5-2/

Timeline

Published: Jun 25, 2026
Last modified: Jun 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-575332.1Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Co CVE-2026-575342.1Malicious HTML content could be injected into the content of a page in the pretix-pages plugin.CVE-2026-575352.1Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these CVE-2026-575366.3Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status CVE-2026-575377.8Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.CVE-2026-57546.1Reflected Cross-Site Scripting (XSS) Vulnerability in Radware Alteon 34.5.4.0 vADC load-balancer allows an attacker to inject malicious scri CVE-2026-575457.8Memory corruption when processing draw objects of incorrect type during graphics command list execution.CVE-2026-575467.5Transient DOS when processing a continuous receive command with a zero-sized global configuration override.CVE-2026-57556.5Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the TIFF IF CVE-2026-575547.8Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.CVE-2026-575557.8Memory Corruption when executing system service routines due to improper handling of user input buffers.CVE-2026-575597.8Memory corruption while processing service requests.