CVE-2025-13742: pretix Email Template Vulnerability Allows Phishing via HTML Injection
Summary
CVE-2025-13742: Emails sent by pretix can utilize placeholders that will be filled with customer data. Affects pretix versions >= 1.0.0, < 2025.7.2. Fixed in 2025.7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pretix is an open-source ticketing solution that allows event organizers to manage ticket sales and attendee registrations. It provides features such as customizable email templates, which can include placeholders for customer data. However, this flexibility can lead to vulnerabilities if user input is not properly sanitized.
Vulnerability Detail
The vulnerability arises from the way pretix handles placeholders in email templates. When a placeholder, such as {name}, is used, it gets replaced with the attendee's name. If the name contains HTML or Markdown formatting, it is rendered as HTML in the email. This allows an attacker to inject maliciously formatted names, potentially leading to phishing attacks. Although pretix employs a strict allow list for HTML tags, the risk of manipulation remains, as user-provided content can appear trustworthy, misleading recipients.
How To Fix
Latest published version: 2026.8.0 as of 22 Oct 2026
pip install --upgrade "pretix==2026.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2025.7.2
This is the first release that contains the fix.
pip install --upgrade "pretix==2025.7.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using user-generated content in email templates or sanitize the input to remove any HTML or Markdown formatting before it is processed.
Conclusion
The CVE-2025-13742 vulnerability in the pretix package poses a risk of HTML injection through email templates, potentially leading to phishing attacks. Users are advised to update to the patched version to mitigate this risk and consider using Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for pretix →
FAQ
CVE-2025-13742 is a vulnerability in the pretix package that allows for HTML injection through email templates, potentially facilitating phishing attacks.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The main risk is that attackers can manipulate email content to appear credible, leading to phishing attempts against users.
Yes, the vulnerability is fixed in pretix version 2025.7.2. It is recommended to update to this version or later.
Vulert is a tool that monitors open-source vulnerabilities in your software using just the Pipfile.lock. It provides real-time alerts for vulnerabilities without requiring code access or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for pretix.
