Indico legt lokale Dateien offen, was zu Remote Code Execution durch LaTeX-Injektion führt

The vulnerability stems from weaknesses in TeXLive and insufficient sanitization of LaTeX syntax within Indico. An attacker can leverage specially crafted LaTeX code to bypass Indico's security measures and gain unauthorized access to the server. This could lead to data breaches, system compromise, and potential disruption of Indico services. The impact is particularly severe because the attacker can execute code with the privileges of the user running the Indico process, potentially escalating privileges to gain full control of the system. This is similar to other LaTeX-based vulnerabilities where malicious code injection can lead to arbitrary command execution.

Organizations using Indico for event management, particularly those relying on server-side LaTeX rendering for document generation or display, are at risk. This includes academic institutions, research organizations, and conference organizers who may be running Indico on shared hosting environments or legacy infrastructure.

• linux / server:

journalctl -u indico | grep -i "latex"

• python:

import os
with open('/opt/indico/indico.conf', 'r') as f:
    if 'XELATEX_PATH' in f.read():
        print('XELATEX_PATH is set - vulnerability may be present')

• generic web:

curl -I http://your-indico-server/some/latex/endpoint

• generic web: Inspect Indico access logs for requests containing unusual or obfuscated LaTeX code.

1. 2026-03-23Disclosure

   disclosure

1. Reserviert2026-03-17
2. Veröffentlicht2026-03-23
3. Geändert2026-03-25
4. EPSS aktualisiert2026-03-31

The primary mitigation is to upgrade to Indico version 3.3.12 or later, which includes the necessary fixes. If upgrading immediately is not possible, disable server-side LaTeX rendering by ensuring the XELATEX_PATH variable is not set in indico.conf. This will prevent the vulnerable LaTeX processing from occurring. Consider implementing a Web Application Firewall (WAF) with rules to filter potentially malicious LaTeX code. Monitor Indico logs for unusual LaTeX processing activity. After upgrading, confirm the fix by attempting to render a known malicious LaTeX snippet and verifying that it is properly sanitized and does not execute arbitrary code.