CVE-2026-33046Disclosure(cern / indico)

LOWCVSS 8.8 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.12, due to vulnerabilities in TeXLive and obscure LaTeX syntax that allowed circumventing Indico's LaTeX sanitizer, it is possible to use specially-crafted LaTeX snippets which can read local files or execute code with the privileges of the user running Indico on the server. Note that if server-side LaTeX rendering is not in use (ie `XELATEX_PATH` was not set in `indico.conf`), this vulnerability does not apply. It is recommended to update to Indico 3.3.12 as soon as possible. It is also strongly recommended to enable the containerized LaTeX renderer (using `podman`), which isolates it from the rest of the system. As a workaround, remove the `XELATEX_PATH` setting from `indico.conf` (or comment it out or set it to `None`) and restart the `indico-uwsgi` and `indico-celery` services to disable LaTeX functionality.

cern CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Other references

https://github.com/indico/indico/releases/tag/v3.3.12

Weakness type (CWE)

CWE-22CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

indico

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked at 3 mentions on most recent observed day (2026-03-24)
4 total mentions across 2 days

Affected systems

Vendors

cern

Products

indico

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

375.0%

General

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-23	1	Disclosure1
2026-03-24	3	Disclosure2General1

Full discourse4 posts

Infoflowcloud@infoflowcloud198d
General
🚨*CVE* CVE-2026-33046 Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.12, due to vulnerabilities i… https://www.cve.org/CVERecord?id=CVE-2026-33046 ----- Traducción: CVE-2026-33046 Ind… http://infoflow.cloud`
Post summary
The information mentions CVE-2026-33046 but lacks specific technical details, proof of concept, exploit code, or patch information, making it a general notification.
0000030
60 followersView on X
CVE@CVEnew198d
Disclosure
CVE-2026-33046 Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.12, due to vulnerabilities i… https://www.cve.org/CVERecord?id=CVE-2026-33046
Post summary
The text announces a CVE affecting Indico’s Flask-Multipass authentication system, noting vulnerable versions but providing no exploit, patch, or detailed technical information.
00000176
56.8K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds199d
Disclosure
CVE-2026-33046 LaTeX Code Execution Vulnerability in Indico Event Management System Before 3.3.12 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33046
Post summary
The passage announces a LaTeX code execution vulnerability in Indico Event Management System prior to version 3.3.12, providing basic technical detail but no exploitation or patch information.
0000053
4.0K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash199d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-33046 - Indico discloses local files resulting in Remote Code Execution through LaTeX injection Intel Report: https://ift.tt/Zb0Diw4
Post summary
The alert announces CVE‑2026‑33046, noting local file disclosure that leads to RCE through LaTeX injection, but provides no PoC, exploit code, patch, or evidence of active exploitation.
0000035
289 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	cern	indico	-	-	-

Explore more

Back to dashboard cern CVEs indico vulnerabilities

What researchers are saying

CVE-2026-33046

Infoflowcloud@infoflowcloudGeneral

The information mentions CVE-2026-33046 but lacks specific technical details, proof of concept, exploit code, or patch information, making it a general notification.

CVE@CVEnewDisclosure

The text announces a CVE affecting Indico’s Flask-Multipass authentication system, noting vulnerable versions but providing no exploit, patch, or detailed technical information.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The passage announces a LaTeX code execution vulnerability in Indico Event Management System prior to version 3.3.12, providing basic technical detail but no exploitation or patch information.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

The alert announces CVE‑2026‑33046, noting local file disclosure that leads to RCE through LaTeX injection, but provides no PoC, exploit code, patch, or evidence of active exploitation.