CVE-2026-76203
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
In maalfer Pentestify versions 1.2.0 through 2.3.2, there is a vulnerability due to incorrect behavior order (validate before canonicalize) in the report theme CSS sanitizer. An authenticated user can force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist.
Risk Assessment
An attacker can use other users' browsers to send HTTP requests, potentially leading to disclosure of sensitive user information (IP, User-Agent) and possibly further attacks.
Recommendation
Upgrade Pentestify to a version newer than 2.3.2, where this vulnerability is fixed.
Other vulnerabilities in Pentestify
See all- CVE-2026-19744Medium
Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization step does not escape quotes.
- CVE-2026-19434Medium
Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when rendering the report.
- CVE-2026-59238Medium
Stored Cross-Site Scripting (CWE-79) in client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's client_logo array, which is interpolated into an <img> src attribute without escaping.
Original NVD description (English source)
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist
Vulnerability data from NVD (NIST) · CISA KEV · EPSS