The vulnerability exists because the default Docker image for Venueless did not enforce a valid Content Security Policy, allowing uploaded SVG files to contain executable JavaScript. When such a file is served, the malicious script runs in the browser context, giving an attacker the ability to execute arbitrary code, steal session information, or perform further attacks. This flaw can affect the confidentiality, integrity, and availability of the system through typical XSS techniques.

Venueless, the open‑source event ticketing platform provided by pretix, is affected when run in the default Docker image configuration delivered by the vendor. No specific software version is listed, so any instance using the base image without a custom CSP header is potentially vulnerable.

The vulnerability carries a CVSS score of 6.4, indicating a moderate severity. The EPSS score is not available, so the current exploitation probability cannot be quantified. The flaw is not listed in the CISA KEV catalog. An attacker can exploit it remotely by uploading a crafted SVG file through the web interface, leveraging the absence of a restrictive CSP to execute arbitrary JavaScript in the victim’s browser. Once activated, the attacker may hijack sessions, exfiltrate data, or pivot to other parts of the infrastructure.