CVE-2023-44464: pretix Vulnerability Allowing Pillow to Parse EPS Files
Summary
CVE-2023-44464: pretix allows Pillow to parse EPS files. Affects pretix versions < 2023.7.2. Fixed in 2023.7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pretix is an open-source event ticketing software that enables users to manage ticket sales and event registrations. It is designed to provide a flexible and user-friendly interface for event organizers. However, prior to version 2023.7.2, pretix had a vulnerability that allowed the Pillow library to parse EPS (Encapsulated PostScript) files, which could lead to potential security risks.
Vulnerability Detail
The vulnerability in pretix arises from its integration with the Pillow library, which is used for image processing. The issue allows malicious EPS files to be processed, potentially leading to remote code execution or other security breaches. This vulnerability is particularly concerning because EPS files can contain executable code, which could be exploited by attackers to compromise the system running pretix.
How To Fix
Latest published version: 2026.8.0 as of 22 Oct 2026
pip install --upgrade "pretix==2026.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2023.7.2
This is the first release that contains the fix.
pip install --upgrade "pretix==2023.7.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid processing EPS files until the package is updated. Ensure that any uploaded files are validated and do not include EPS formats.
Conclusion
The vulnerability CVE-2023-44464 in the pretix package poses significant security risks due to the ability of the Pillow library to parse EPS files. It is crucial to update to version 2023.7.2 or later to mitigate these risks. Users should also consider using Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for pretix →
FAQ
CVE-2023-44464 is a vulnerability in the pretix package that allows the Pillow library to parse EPS files, potentially leading to security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include remote code execution and other security breaches due to the ability to process malicious EPS files.
You can update pretix by running the command pip install --upgrade pretix in your terminal.
If you cannot update immediately, avoid processing EPS files and validate any uploaded files to ensure they do not pose a security risk.
Related vulnerabilities
Recent vulnerabilities recorded for pretix.
