{"id":"CVE-2023-28459","aliases":["EUVD-2023-0206","GHSA-wh3w-jcc7-mhmf","PYSEC-2023-41"],"status":"published","title":"pretalx vulnerable to path traversal in HTML export","description":"pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.06648,"percentile":0.93924,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2023-04-20T00:00:00Z","modified":"2026-10-28T02:30:46Z","exploits":[{"source":"metasploit","id":"auxiliary/scanner/http/pretalx_file_read_cve_2023_28459","title":"Pretalx Arbitrary File Read/Limited File Write","type":"auxiliary","date":"2023-03-07","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/pretalx_file_read_cve_2023_28459"}],"fixes":[{"ecosystem":"PyPI","package":"pretalx","fixed_in":["2.3.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pretalx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pretalx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2"}]}],"versions":["0.1.0","0.2.0.post1","0.2.1.post1","0.2.2","0.3.0","0.3.1","0.4.0","0.4.1","0.5.0","0.6.0","0.6.1","0.7.0","0.7.1","0.8.0","0.9.0","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.1","1.1.2","2.0.0","2.1.0","2.1.1","2.2.0","2.3.0","2.3.1"]},{"source":"osv","ecosystem":"PyPI","package":"pretalx","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"60722c43cf975f319e94102e6bff320723776890"}]},{"type":"ECOSYSTEM","events":[{"introduced":"2.3.1"},{"fixed":"2.3.2"}]}],"versions":["2.3.1","v2.3.1","v2.3.0","v2.2.0","v2.1.1","v2.1.0","v2.0.0","v1.1.0","v1.0.0","v0.9.0","v0.8.0","v0.7.1","v0.7.0","v0.6.1","v0.6.0","v0.5.0","v0.4.1","v0.4.0","v0.3.1","v0.3.0","v0.2.2","v0.2.1","v0.2.0","v0.1.0"]}],"products":[{"vendor":"pretalx","product":"pretalx"}],"references":[{"url":"https://pretalx.com/p/news/security-release-232/","tags":["x_transferred","Vendor Advisory","web"]},{"url":"https://github.com/pretalx/pretalx/commit/60722c43cf975f319e94102e6bff320723776890","tags":["x_transferred","Patch","fix","web"]},{"url":"https://github.com/pretalx/pretalx/releases/tag/v2.3.2","tags":["x_transferred","Release Notes","web"]},{"url":"https://www.sonarsource.com/blog/pretalx-vulnerabilities-how-to-get-accepted-at-every-conference/","tags":["x_transferred","Exploit","Patch","Third Party Advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28459","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pretalx/PYSEC-2023-41.yaml","tags":["web"]},{"url":"https://pretalx.com/p/news/security-release-232","tags":["web"]},{"url":"https://www.sonarsource.com/blog/pretalx-vulnerabilities-how-to-get-accepted-at-every-conference","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wh3w-jcc7-mhmf","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28459.json","tags":["advisory"]},{"url":"https://github.com/pretalx/pretalx","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-28459","description":"pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files.","status":"published","published":"2023-04-20T00:00:00Z","modified":"2025-02-05T16:14:54.17Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:35:32.376766Z"}],"euvd":[{"id":"EUVD-2023-0206","description":"pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files.","status":"published","published":"2023-04-20T00:00:00Z","modified":"2025-02-05T16:14:54Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:05.079502Z"}],"ghsa":[{"id":"GHSA-wh3w-jcc7-mhmf","title":"pretalx vulnerable to path traversal in HTML export","description":"pretalx before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files.","status":"published","published":"2023-04-20T21:33:27Z","modified":"2024-10-21T20:10:15Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:38:12.325695Z"}],"nvd":[{"id":"CVE-2023-28459","description":"pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files.","status":"published","published":"2023-04-20T21:15:08.823Z","modified":"2026-06-17T05:47:47.1Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:56.683259Z"}],"osv":[{"id":"CVE-2023-28459","description":"pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files.","status":"published","published":"2023-04-20T00:00:00Z","modified":"2026-10-28T02:30:46.937637637Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"GHSA-wh3w-jcc7-mhmf","title":"pretalx vulnerable to path traversal in HTML export","description":"pretalx before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files.","status":"published","published":"2023-04-20T21:33:27Z","modified":"2024-10-21T20:25:46.741341Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"PYSEC-2023-41","description":"pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files.","status":"published","published":"2023-04-20T21:15:00Z","modified":"2026-06-10T17:01:44.279398144Z","updated_at":"2026-11-02T15:52:53.837392Z"}]}}