6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41426

CVE-2026-41426: pretalx: Email injection via unescaped user-controlled placeholders in pretalx mail templates

pretalx is a conference planning tool. Prior to 2026.1.0, an unauthenticated attacker can send arbitrary HTML-rendered emails from a pretalx instance's configured sender address by embedding malformed HTML or markdown link syntax in a user-controlled template placeholder such as the account display name. The most direct vector is the password-reset flow: the attacker registers an account with a malicious name, enters the victim's email address, and triggers a password reset. The resulting email is delivered from the event's legitimate sender address and passes SPF/DKIM/DMARC validation, making it a ready-made phishing vector. This vulnerability is fixed in 2026.1.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41426

CVE-2026-41426:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pretalx	pip	< 2026.1.0	2026.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an email injection issue in pretalx, caused by unescaped user-controlled placeholders in email templates. An attacker could register an account with a malicious name (e.g., containing HTML or markdown link syntax) and then trigger an action that sends an email, such as a password reset. The malicious name would be rendered as HTML in the email, allowing the attacker to send phishing emails from a trusted source.

The patch addresses this by implementing a new trust-aware email formatting system. The key changes are:

Introduction of pretalx.common.text.formatting.py: This new module provides a safe format_map function that handles trusted and untrusted content differently. It uses a SafeFormatter that prevents common format string abuse and can dispatch on EmailAlternativeString objects which hold separate plain-text and HTML representations of a value.
New Placeholder Classes: The patch introduces new placeholder classes in pretalx.mail.placeholders.py (e.g., UntrustedPlainMailTextPlaceholder, UntrustedMarkdownMailTextPlaceholder). These classes are now used for placeholders that render user-controlled content. They ensure that the output is properly escaped for both plain text and HTML emails.
Updates to MailTemplate.to_mail: This core function in src/pretalx/mail/models.py was updated to use the new safe format_map and a new render_mail_body function that is aware of the new escaping mechanisms.
Updates to Data-providing Functions: Functions that provide content for emails, like Submission.get_content_for_mail, were refactored. The call sites were updated to use new safe methods (e.g., _content_for_mail_placeholder) that return sanitized content wrapped in EmailAlternativeString.

The identified vulnerable functions are central to the process of creating and sending emails with user-provided data. MailTemplate.to_mail is the main entry point for rendering and sending emails. Submission.get_content_for_mail is an example of a function that provided raw, unescaped user data to the templating system. The new format_map function represents the core of the fix, and its absence in a safe form was the root cause of the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.