CVE-2023-28458 pretalx allows path traversal in HTML export

Medium 4.3 Published 20 Apr 2023 Updated 5 Feb 2025

Organizers can overwrite arbitrary files via path traversal in the non-default HTML export feature of pretalx.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-28458?

CVE-2023-28458 is a medium-severity path traversal vulnerability in n/a, published on 20 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the overwriting (with the standard pretalx 404 page content) of an arbitrary file.

Weakness: CWE-22

Which versions are affected by CVE-2023-28458?

3 open source packages ship an affected version, including pretalx. It affects 1 product.

Package	Affected	Fixed in
`pretalx` PyPI	From `2.3.1`	`2.3.2`
`pretalx` PyPI	From `2.3.1`	`2.3.2`
`pretalx` PyPI	From `2.3.1`	`2.3.2`

Products include Pretalx Pretalx.

How do I fix CVE-2023-28458?

Upgrade pretalx to 2.3.2 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-28458 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-28458 exists.

Public exploit code: 2 Metasploit modules.

Sources

Also known as GHSA-23fx-92m6-4f2g, PYSEC-2023-40.