pretix mishandles file validation

Description

References

• nvd.nist.gov/vuln/detail/CVE-2024-27447 · ADVISORY
• pretix/pretix · PACKAGE
• pretix/pretix · WEB
• pypa/advisory-database · WEB
• GitHub Advisory GHSA-672r-97r7-vx2q · ADVISORY

More vulnerabilities in pretix

• CVE-2026-9712LOW 3.8When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35…
• CVE-2026-5600MEDIUM 4.3A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-…
• CVE-2026-2415MEDIUM 5.9Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email templat…
• CVE-2025-14882LOW 3.8An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible b…
• CVE-2025-14881LOW 3.8Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be acces…