A critical vulnerability in the Indico event management system allows authenticated users to achieve remote code execution or unauthorized file access through malicious LaTeX rendering inputs.

This vulnerability involves an improper neutralization of OS command elements and path traversal flaws within the LaTeX rendering pipeline. An authenticated attacker can bypass existing sanitizers using obscure LaTeX syntax to execute commands or read files with the privileges of the Indico service user.

The ability for an attacker to execute arbitrary code or read sensitive files on the host server poses a significant risk to the confidentiality, integrity, and availability of the entire Indico platform. Given the CVSS score of 8.8, this flaw represents a high-severity risk that could lead to full system compromise, data theft, or lateral movement within the hosting network.

Immediate Action: Update Indico to version 3.3.12 immediately. If an update is not immediately feasible, disable LaTeX rendering by setting XELATEX_PATH to None in indico.conf and restarting the indico-uwsgi and indico-celery services.

Proactive Monitoring: Review server access logs for anomalous LaTeX rendering requests or unexpected shell command execution patterns. Monitor process creation logs for suspicious activity originating from the Indico service account.

Compensating Controls: Implement containerized LaTeX rendering using podman as recommended by the vendor to isolate the rendering engine from the host operating system. Ensure the Indico service is running with the least privilege necessary to limit the impact of potential command execution.

Public Exploit Available: Unknown

This vulnerability presents a severe risk to any Indico deployment utilizing LaTeX rendering. Administrators must prioritize the upgrade to version 3.3.12 as the primary defense. If immediate patching is not possible, the provided configuration workaround is essential to neutralize the attack vector until a maintenance window can be scheduled.