Read the docs
TI-2026-53309 Aliases CVE-2026-76203GHSA-6xgw-5q2h-p29f

CSS sanitizer bypass in Pentestify report themes allows forced outbound requests

Priority LOW 23CWE-180Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00397 34th percentileScored 2026-11-07
Fix Fixed Pentestify (maalfer): 1ed1aad

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
maalferPentestify1.2.0 to before 1ed1aad1ed1aadPatch availableCNA
  • Pentestify Vendormaalfer Affected 1.2.0 to before 1ed1aad Fixed in 1ed1aad Patch available CNA

Remediation

  • Fix · CNA Pentestify (maalfer) Fixed in 1ed1aad

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76203
  2. 2026-10-03 Alias added: GHSA-6xgw-5q2h-p29f

References

Patch 1

Other 1

  • TI-2026-42379 Stored XSS in Pentestify via unsanitized finding images and report client logo CVSS 4.0MEDIUM 6.9
  • TI-2026-53112 HTML Injection in MailerUp double opt-in verification email CVSS 4.0MEDIUM 6.9
  • TI-2026-16010 Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes CVSS 4.0MEDIUM 5.1
  • TI-2026-15995 Stored Cross-site Scripting in Pentestify user account deletion via unescaped username CVSS 4.0MEDIUM 5.1
  • TI-2026-15841 Stored Cross-site Scripting in Pentestify finding severity field CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences