CVE-2024-8113: pretix Stored Cross-site Scripting Vulnerability
Summary
CVE-2024-8113: pretix Stored Cross-site Scripting vulnerability. Affects pretix versions < 2024.7.1. Fixed in 2024.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pretix is an open-source ticketing solution that allows event organizers to manage ticket sales and event settings efficiently. It provides features such as customizable event pages, ticket types, and payment integrations. However, like many web applications, it is susceptible to security vulnerabilities, including Cross-site Scripting (XSS), which can compromise user data and application integrity.
Vulnerability Detail
The vulnerability identified as CVE-2024-8113 is a Stored Cross-site Scripting (XSS) flaw found in the organizer and event settings of pretix versions up to 2024.7.0. This vulnerability allows malicious event organizers to inject HTML tags into email previews on the settings page. While the default Content Security Policy (CSP) of pretix mitigates the risk of executing attacker-provided scripts, the potential for exploitation exists if a CSP bypass is discovered. This could lead to impersonation of other organizers or staff users, posing significant security risks.
How To Fix
Latest published version: 2026.8.0 as of 22 Oct 2026
pip install --upgrade "pretix==2026.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2024.7.1
This is the first release that contains the fix.
pip install --upgrade "pretix==2024.7.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as possible.
Conclusion
The CVE-2024-8113 vulnerability in pretix poses a significant risk due to its potential for Stored XSS attacks. It is crucial for users to update to version 2024.7.1 or later to mitigate this risk. Regular monitoring and updates are essential to maintain the security of your applications.
See every vulnerability recorded for pretix →
FAQ
Stored XSS is a type of security vulnerability where an attacker can inject malicious scripts into content that is stored on a server and then served to users. This can lead to unauthorized actions or data theft.
If you are using pretix version 2024.7.0 or earlier, your installation is affected by this vulnerability. You can check your version by running 'pip show pretix' in your terminal.
The primary risk is the potential for an attacker to impersonate other users, which could lead to unauthorized access to sensitive information or actions within the pretix application.
Yes, you can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software. It requires no installation and uses the Pipfile.lock to provide real-time alerts.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for pretix.
