CVE-2026-33046: Indico discloses local files resulting in Remote Code Execution through LaTeX injection
[!NOTE] If server-side LaTeX rendering is not in use (ie XELATEXPATH was not set in indico.conf), this vulnerability does not apply.
Impact Due to vulnerabilities in TeXLive and obscure LaTeX syntax that allowed circumventing Indico's LaTeX sanitizer, it is possible to use specially-crafted LaTeX snippets which can read local files or execute code with the privileges of the user running Indico on the server.
Patches It is recommended to update to Indico 3.3.12 as soon as possible. See the docs for instructions on how to update.
It is also strongly recommended to enable the containerized LaTeX renderer (using podman), which isolates it from the rest of the system. See the docs for details - it is very easy and from now on the only recommended/supported way of using LaTeX.
Workarounds Remove the XELATEXPATH setting from indico.conf (or comment it out or set it to None) and restart the indico-uwsgi and indico-celery services to disable LaTeX functionality.
For more information For any questions or comments about this advisory:
- Open a thread in the forum - Send an email to indico-team@cern.ch
Other sources
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.12, due to vulnerabilities in TeXLive and obscure LaTeX syntax that allowed circumventing Indico's LaTeX sanitizer, it is possible to use specially-crafted LaTeX snippets which can read local files or execute code with the privileges of the user running Indico on the server. Note that if server-side LaTeX rendering is not in use (ie XELATEXPATH was not set in indico.conf), this vulnerability does not apply. It is recommended to update to Indico 3.3.12 as soon as possible. It is also strongly recommended to enable the containerized LaTeX renderer (using podman), which isolates it from the rest of the system. As a workaround, remove the XELATEXPATH setting from indico.conf (or comment it out or set it to None) and restart the indico-uwsgi and indico-celery services to disable LaTeX functionality.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33046?
CVE-2026-33046 has been classified as a high-severity vulnerability due to its ability to exploit server-side LaTeX rendering.
How do I fix CVE-2026-33046?
To mitigate CVE-2026-33046, update Indico to version 3.3.12 or later.
Which versions of Indico are affected by CVE-2026-33046?
CVE-2026-33046 affects Indico versions prior to 3.3.12.
What component is primarily responsible for the vulnerability in CVE-2026-33046?
The vulnerability is primarily due to issues in TeXLive and improper handling of LaTeX syntax in Indico.
Is CVE-2026-33046 relevant if server-side LaTeX rendering is disabled?
No, CVE-2026-33046 does not apply if server-side LaTeX rendering is not in use.