CVE-2026-2415: pretix Email Template Vulnerability Allows Information Exfiltration
Summary
CVE-2026-2415: pretix unsafely evaluates variables in emails. Affects pretix across 3 version ranges.
< 2025.9.4
>= 2025.10.0, < 2025.10.2
>= 2026.1.0, < 2026.1.1
Fixed in 2025.9.4, 2025.10.2 or 2026.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pretix is an open-source ticketing solution that allows event organizers to manage ticket sales and customer interactions. It features customizable email templates that can include placeholders for dynamic content, such as customer names and order details. However, the system's handling of these placeholders has led to security vulnerabilities that could expose sensitive information.
Vulnerability Detail
The vulnerability arises from the way pretix evaluates placeholders in email templates. Attackers can exploit this by crafting malicious placeholder names to exfiltrate sensitive information from the system, including database passwords and API keys. Additionally, the double evaluation of placeholders allows ticket buyers to manipulate the content of emails, potentially leaking information about orders to unauthorized attendees. This vulnerability is particularly concerning as it can be exploited by any user with access to the email template system.
How To Fix
Latest published version: 2026.8.0 as of 22 Oct 2026
pip install --upgrade "pretix==2026.8.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2025.9.42025.9.4pip install --upgrade "pretix==2025.9.4" -
>= 2025.10.0, < 2025.10.22025.10.2pip install --upgrade "pretix==2025.10.2" -
>= 2026.1.0, < 2026.1.12026.1.1pip install --upgrade "pretix==2026.1.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using placeholders in email subjects and bodies that could be controlled by ticket buyers. Regularly review and sanitize email templates to prevent the inclusion of potentially harmful placeholders.
Conclusion
The CVE-2026-2415 vulnerability in pretix poses significant risks due to improper handling of email template placeholders. Users are strongly advised to update their systems to the latest versions to mitigate these risks and protect sensitive information.
See every vulnerability recorded for pretix →
FAQ
CVE-2026-2415 is a vulnerability in the pretix ticketing system that allows attackers to exfiltrate sensitive information through email template placeholders.
Any user of the pretix system who has access to email templates is potentially affected, especially if they can control the content of those templates.
Attackers could gain access to sensitive information such as database passwords and API keys, leading to further exploitation of the system.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, review and sanitize your email templates to prevent the use of dangerous placeholders as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for pretix.
