← Vulnerability feed
Start free
Open in platform
Vulnerability record · CVE-2024-27447 · published 26 February 2024
CVE-2024-27447: Pretix improper input validation vulnerability
Pretix · Pretix
pretix before 2024.1.1 mishandles file validation.
9.8 CVSS 3.1 Critical EPSS 0.82% · top 44.4% CWE-20 · Improper input validation
9.8CVSS 3.1 base score
0.82%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD
Description
pretix before 2024.1.1 mishandles file validation.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/pretix/pretix/compare/v2023.10.2...v2024.1.1 | Release Notes |
| https://github.com/pretix/pretix/compare/v2023.10.2...v2024.1.1 | Release Notes |
Track CVE-2024-27447 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
7.5CVE-2026-2415Pretix vulnerabilityEmails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will…EPSS 0.25%7.5CVE-2026-2451Pretix double opt in step vulnerabilityEmails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will…EPSS 0.27%7.5CVE-2026-2452Pretix newsletters vulnerabilityEmails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will…EPSS 0.27%7.2CVE-2024-8113Pretix cross-site scripting vulnerabilityStored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on set…EPSS 0.32%5.5CVE-2026-5600Pretix vulnerabilityA new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events b…EPSS 0.31%2.4CVE-2025-13742Pretix vulnerabilityEmails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will…EPSS 0.18%
Source: NIST National Vulnerability Database (record CVE-2024-27447), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
