CVE-2026-33046
Received Received - Intake
LaTeX Injection in Indico Allows Local File Read and Code Execution

Publication date: 2026-03-23

Last updated on: 2026-03-24

Assigner: GitHub, Inc.

Description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.12, due to vulnerabilities in TeXLive and obscure LaTeX syntax that allowed circumventing Indico's LaTeX sanitizer, it is possible to use specially-crafted LaTeX snippets which can read local files or execute code with the privileges of the user running Indico on the server. Note that if server-side LaTeX rendering is not in use (ie `XELATEX_PATH` was not set in `indico.conf`), this vulnerability does not apply. It is recommended to update to Indico 3.3.12 as soon as possible. It is also strongly recommended to enable the containerized LaTeX renderer (using `podman`), which isolates it from the rest of the system. As a workaround, remove the `XELATEX_PATH` setting from `indico.conf` (or comment it out or set it to `None`) and restart the `indico-uwsgi` and `indico-celery` services to disable LaTeX functionality.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-23
Last Modified
2026-03-24
Generated
2026-06-16
AI Q&A
2026-03-24
EPSS Evaluated
2026-06-15
NVD
CVE-2026-33046
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
cern indico to 3.3.12 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects Indico, an event management system that uses Flask-Multipass for authentication. In versions prior to 3.3.12, due to vulnerabilities in TeXLive and obscure LaTeX syntax, it is possible to bypass Indico's LaTeX sanitizer. This allows an attacker to use specially-crafted LaTeX snippets to read local files or execute code with the same privileges as the user running Indico on the server.

The vulnerability only applies if server-side LaTeX rendering is enabled (i.e., if the XELATEX_PATH setting is configured in indico.conf). If this setting is not enabled, the vulnerability does not apply.

To mitigate this vulnerability, it is recommended to update Indico to version 3.3.12 or later, enable the containerized LaTeX renderer to isolate LaTeX processing, or disable LaTeX functionality by removing or commenting out the XELATEX_PATH setting and restarting relevant services.

Compliance Impact

I don't know

Detection Guidance

I don't know

Impact Analysis

This vulnerability can have serious impacts because it allows an attacker to read local files or execute arbitrary code on the server with the privileges of the Indico user. This can lead to unauthorized access to sensitive information, data leakage, or full compromise of the server hosting Indico.

If exploited, it could result in loss of confidentiality, integrity, and availability of the system and its data.

Mitigation Strategies

To mitigate this vulnerability, it is recommended to update Indico to version 3.3.12 as soon as possible.

It is strongly recommended to enable the containerized LaTeX renderer using podman, which isolates the LaTeX rendering process from the rest of the system.

As a workaround, you can remove the XELATEX_PATH setting from the indico.conf file (or comment it out or set it to None) and then restart the indico-uwsgi and indico-celery services to disable LaTeX functionality.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33046. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart