The pretalx conference planning tool is affected by a stored cross-site scripting vulnerability that allows low-privileged users to execute arbitrary code in the context of an administrator's browser session.

This vulnerability is a stored cross-site scripting (CWE-79) flaw occurring because the application uses innerHTML string interpolation to render user-controlled fields. An authenticated attacker can inject malicious HTML or JavaScript into submission titles or profile names, which triggers when an administrator searches for that record.

Successful exploitation allows an attacker to perform actions on behalf of an administrator, potentially leading to unauthorized data access, account takeover, or configuration changes within the conference management system. Given the CVSS score of 8.7, this vulnerability poses a significant risk to the integrity and confidentiality of the platform.

Immediate Action: Update the pretalx installation to version 2026.1.0 or later to include the necessary input sanitization fixes.

Proactive Monitoring: Review administrative audit logs for unusual search activity or unexpected modifications to submission metadata and user profile fields.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized inline scripts and leverage a Web Application Firewall to block common XSS injection patterns.

Public Exploit Available: No (unknown)

Organizations utilizing pretalx for conference management must prioritize the upgrade to version 2026.1.0. Failure to patch allows any authenticated user to potentially compromise the administrative backend, making immediate remediation essential to maintaining the security posture of the platform.