id: PYSEC-2024-253
modified: 2025-06-11T15:23:51.683422Z
published: 2024-02-26T16:28:00Z
aliases:
- CVE-2024-27447
- GHSA-672r-97r7-vx2q
details: pretix before 2024.1.1 mishandles file validation.
affected:
- package:
    ecosystem: PyPI
    name: pretix
    purl: pkg:pypi/pretix
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2024.1.1
  versions:
  - 1.0.0
  - 1.0.0b1
  - 1.0.0b2
  - 1.1.0
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.10.0
  - 1.10.1
  - 1.11.0
  - 1.11.1
  - 1.12.0
  - 1.12.1
  - 1.13.0
  - 1.13.1
  - 1.14.0
  - 1.15.0
  - 1.15.1
  - 1.15.2
  - 1.16.0
  - 1.17.0
  - 1.17.1
  - 1.2.0
  - 1.2.1.post2
  - 1.2.2
  - 1.3.0
  - 1.3.0.post1
  - 1.3.1
  - 1.4.0
  - 1.4.1
  - 1.5.0
  - 1.5.1
  - 1.5.2
  - 1.6.0
  - 1.6.1
  - 1.6.2
  - 1.7.1
  - 1.7.2
  - 1.8.0
  - 1.8.1
  - 1.9.0
  - 1.9.1
  - 2.0.0
  - 2.1.0
  - 2.2.0
  - 2.3.0
  - 2.4.0
  - 2.5.0
  - 2.6.0
  - 2.7.0
  - 2.7.1
  - 2.7.2
  - 2.8.2
  - 2023.10.0
  - 2023.10.1.post1
  - 2023.10.2
  - 2023.6.0
  - 2023.6.1
  - 2023.6.3
  - 2023.7.0
  - 2023.7.1
  - 2023.7.3
  - 2023.8.0
  - 2023.8.1
  - 2023.9.0
  - 2023.9.1
  - 2024.1.0
  - 3.0.0
  - 3.0.1
  - 3.1.0
  - 3.10.0
  - 3.11.0
  - 3.11.1
  - 3.12.0
  - 3.12.1
  - 3.13.0
  - 3.13.1
  - 3.14.0
  - 3.14.1
  - 3.14.2
  - 3.15.0
  - 3.16.0
  - 3.17.1
  - 3.17.2
  - 3.18.0
  - 3.2.0
  - 3.3.0
  - 3.4.0
  - 3.5.0
  - 3.6.0
  - 3.6.0.post1
  - 3.7.0
  - 3.8.0
  - 3.9.0
  - 4.0.0
  - 4.1.0
  - 4.10.0
  - 4.10.1
  - 4.11.0
  - 4.11.1
  - 4.12.0
  - 4.13.0
  - 4.13.1
  - 4.14.0
  - 4.14.0.dev0
  - 4.15.0
  - 4.15.0.dev0
  - 4.15.1
  - 4.16.0
  - 4.16.1
  - 4.17.0
  - 4.17.1
  - 4.18.0
  - 4.18.1
  - 4.18.2
  - 4.18.2.post1
  - 4.19.0
  - 4.2.0
  - 4.20.0
  - 4.20.1
  - 4.20.2.post1
  - 4.20.4
  - 4.3.0
  - 4.3.1
  - 4.4.0
  - 4.4.1
  - 4.5.0
  - 4.5.1
  - 4.5.2
  - 4.6.0
  - 4.6.1
  - 4.7.0
  - 4.7.1
  - 4.8.0
  - 4.9.0
  - 4.9.1
references:
- type: WEB
  url: https://github.com/pretix/pretix/compare/v2023.10.2...v2024.1.1
- type: ADVISORY
  url: https://github.com/advisories/GHSA-672r-97r7-vx2q