CVE-2026-2415: pretix Information Disclosure Vulnerability

CVE-2026-2415 Overview

CVE-2026-2415 is a high-severity information disclosure vulnerability in pretix, an open-source ticketing software. The vulnerability exists in the email template placeholder mechanism, which allows email templates to include dynamic placeholders that are filled with customer data. Due to improper input validation, attackers can craft malicious placeholder names to exfiltrate sensitive system information, including database passwords and API keys.

Critical Impact

Attackers with access to email templates can exfiltrate sensitive configuration data including database credentials and API keys through specially crafted placeholders. A secondary double-evaluation bug expands the attack surface to ticket buyers under certain conditions.

Affected Products

• pretix (versions prior to 2026.1.1)

Discovery Timeline

• 2026-02-16 - CVE-2026-2415 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-2415

Vulnerability Analysis

This vulnerability stems from two distinct but related security flaws in pretix's email template placeholder system. The first flaw involves insufficient sanitization of placeholder names, allowing attackers to inject Python object traversal patterns like {{event.__init__.__code__.co_filename}} to access internal system attributes. While pretix implements mechanisms to prevent malicious placeholders, a coding error rendered these protections ineffective for email subject lines.

The second flaw involves double evaluation of placeholders in email subjects and plain text bodies. When a placeholder's first evaluation result contains another placeholder syntax, the system incorrectly processes the nested placeholder. This creates a path for ticket buyers to exploit the first vulnerability if their controlled data (such as {invoice_company}) appears in email subject templates.

Root Cause

The root cause is classified as CWE-627 (Dynamic Variable Evaluation), where the application dynamically evaluates user-controlled input as variable names or code references without adequate restrictions. The placeholder parsing logic fails to properly sanitize input in email subjects, and the double-evaluation behavior amplifies the attack surface by allowing indirect injection of malicious placeholder patterns through buyer-controlled fields.

Attack Vector

The attack is network-accessible and requires low privileges—typically any authenticated backend user with email template editing permissions. For the secondary attack path, a ticket buyer could potentially exploit this by including placeholder syntax in invoice company names, though this requires the specific field to be included in email subject templates, which is uncommon in typical deployments.

An attacker would craft a malicious placeholder such as {{event.__init__.__code__.co_filename}} in an email template subject line. When the email is generated, the placeholder traverses Python object attributes to access sensitive configuration values, which are then rendered into the email content and potentially visible to the attacker or exfiltrated through the email delivery process.

Detection Methods for CVE-2026-2415

Indicators of Compromise

• Unusual placeholder patterns in email templates containing Python dunder methods (e.g., __init__, __class__, __code__)
• Email templates with nested or chained placeholder references
• Audit log entries showing template modifications with object traversal syntax
• Unexpected access patterns to email template configuration interfaces

Detection Strategies

• Monitor email template changes for patterns matching object attribute traversal (regex patterns like \{\{.*__.*__.*\}\})
• Implement alerting on email template modifications containing suspicious placeholder names
• Review outbound emails for anomalous content that may indicate successful data exfiltration
• Audit authentication logs for unusual backend user activity around template management features

Monitoring Recommendations

• Enable comprehensive logging for all email template creation and modification events
• Configure SIEM rules to detect placeholder patterns indicative of object injection attempts
• Monitor for changes to the pretix.cfg configuration file that may indicate post-exploitation activity
• Implement file integrity monitoring on pretix configuration directories

How to Mitigate CVE-2026-2415

Immediate Actions Required

• Update pretix to version 2026.1.1 or later immediately
• Rotate all passwords and API keys contained in your pretix.cfg configuration file
• Audit existing email templates for any suspicious or malicious placeholder patterns
• Review access logs for email template modification activity

Patch Information

The pretix development team has released version 2026.1.1 to address this vulnerability. The fix implements proper placeholder validation across all email template components, including subject lines, and eliminates the double-evaluation behavior. Organizations should upgrade to this version as soon as possible. For detailed release information, see the Pretix Blog Release Announcement.

Workarounds

• Restrict email template editing permissions to only trusted administrators until patching is complete
• Remove any buyer-controlled placeholders (such as {invoice_company}) from email subject templates
• Implement network-level monitoring for outbound emails containing unexpected configuration data
• Consider temporarily disabling custom email templates if immediate patching is not feasible

# Post-update credential rotation steps
# 1. Generate new database password
# 2. Update pretix.cfg with new credentials
# 3. Rotate all API keys referenced in configuration
# 4. Restart pretix services to apply changes