CVE-2023-28458

Vulnerability

CVE-2023-28458 is a path traversal vulnerability in pretalx 2.3.1 before 2.3.2, affecting the off-by-default HTML export functionality. The export feature creates a zip archive of event pages, including user-uploaded files like presentations. Due to insufficient input validation, an organizer can craft an uploaded HTML file containing path traversal sequences (e.g., ../). When the export is generated, pretalx follows these sequences to read arbitrary files from the server [1][4].

Exploitation

To exploit this vulnerability, an attacker must have organizer-level access to a pretalx instance. The attack starts by uploading a malicious HTML file as part of a talk submission. Later, when the organizer triggers the HTML export, the traversal payload causes pretalx to include arbitrary files in the exported archive. The same mechanism also allows the attacker to overwrite (not read) arbitrary files with the content of pretalx's standard 404 page [1][4]. No authentication bypass is required; the attacker simply leverages their existing organizer privileges.

Impact

An attacker exploiting CVE-2023-28458 can read sensitive files from the pretalx server, such as configuration files containing database credentials or secret keys, potentially leading to further compromise. Additionally, the file write capability could overwrite application files or system resources, though the 404 page content limits this vector. On self-hosted instances, this elevates an organizer's privileges to potentially full server access, depending on the file system permissions [1][2].

Mitigation

Pretalx released version 2.3.2 on March 7, 2023, which fixes this vulnerability by properly validating file paths during HTML export. Users of pretalx.com are automatically protected. Self-hosted instances should update to 2.3.2 or later immediately. No workarounds are available; the vulnerability is closed only by upgrading [4].