PyPIPackage

pretalx

4 known vulnerabilities (1 high, 3 medium), with the versions each affects and the releases that fix them.

Version timeline

CVE-2026-41426
Affects 0.1.0 to 2025.2.2 (2026.1.0 is outside it)
CVE-2026-41241
Affects 0.1.0 to 2025.2.2 (2026.1.0 is outside it)
CVE-2023-28459
Affects 0.1.0 to 2.3.1 (2.3.2 is outside it)
CVE-2023-28458
Affects 0.1.0 (0.2.0.post1 is outside it); 0.2.2 to 1.0.0 (1.0.1 is outside it); 1.1.0 (1.1.1 is outside it); 2.0.0 to 2.3.1 (2.3.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-41426Medium 6.1
pretalx: Email injection via unescaped user-controlled placeholders in pretalx mail templates
Affected: fixed in 2026.1.0.
Fixed in 2026.1.0 (released Apr 17, 2026, 7 days before disclosure).
The latest release, 2026.2.1, is not affected.
CVE-2026-41241High 8.7
pretalx: Stored cross-site scripting in organiser search typeahead
Affected: fixed in 2026.1.0.
Fixed in 2026.1.0 (released Apr 17, 2026, 6 days before disclosure).
The latest release, 2026.2.1, is not affected.
CVE-2023-28459Medium 6.5
pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature).
Affected: fixed in 2.3.2; from 2.3.1, fixed in 2.3.2.
Fixed in 2.3.2 (released Mar 7, 2023, 44 days before disclosure).
The latest release, 2026.2.1, is not affected.
CVE-2023-28458Medium 4.3
pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature).
Affected: from 2.3.1, fixed in 2.3.2; from 2.3.1, fixed in 2.3.2.
Fixed in 2.3.2 (released Mar 7, 2023, 44 days before disclosure).
The latest release, 2026.2.1, is not affected.