CVE-2026-2451
Information Disclosure via Insecure Placeholder Handling in pretix Emails
Publication date: 2026-02-16
Last updated on: 2026-03-13
Assigner: rami.io
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pretix | pretix | From 4.16.0 (inc) to 2026.1.1 (exc) |
| pretix | double_opt_in_step | to 1.3.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-627 | In a language where the user can influence the name of a variable at runtime, if the variable names are not controlled, an attacker can read or write to arbitrary variables, or access arbitrary functions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in pretix's email template system, where placeholders in emails are replaced with customer data. An attacker who can control email templates can use specially crafted placeholder names to exfiltrate sensitive system information.
For example, using a placeholder like {{event.__init__.__code__.co_filename}} allows an attacker to retrieve sensitive data such as database passwords or API keys from the system configuration.
Although pretix includes mechanisms to block malicious placeholders, a coding mistake made these protections ineffective for this plugin.
How can this vulnerability impact me? :
If exploited, this vulnerability can lead to the exposure of sensitive information including database passwords and API keys.
An attacker with access to the pretix backend user interface could extract confidential system configuration data, potentially compromising the entire system's security.
As a precaution, it is recommended to rotate all passwords and API keys stored in the pretix configuration file after addressing this vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update your pretix installation to the latest security release as soon as possible.
Additionally, it is recommended to rotate all passwords and API keys contained in your pretix.cfg file to prevent potential misuse of leaked credentials.