Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-76203

CSS sanitizer bypass in Pentestify report themes allows forced outbound requests

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Secur0

Description

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

maalfer Pentestify

Default version status: unaffected

  • 1.2.0 to < 1ed1aadaffected

References