CVE-2026-82838

Default webserver configuration with incorrect CSP PUBLISHED

Description (CNA)

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.

Affected (CNA)

Vendor / product	Versions
pretix / venueless	affected 0 before 7dff888

CWE

CWE-80

References

https://github.com/venueless/venueless/security/advisories/GHSA-38wh-hqvm-xgfc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.