CVE-2023-28458

Advisory

pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the overwriting (with the standard pretalx 404 page content) of an arbitrary file.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/pretalx/pretalx/commit/60722c43cf975f319e94102e6bff320723776890
• https://www.sonarsource.com/blog/pretalx-vulnerabilities-how-to-get-accepted-at-every-conference/
• https://github.com/pretalx/pretalx/releases/tag/v2.3.2
• https://pretalx.com/p/news/security-release-232/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28458