CVE-2026-76203
CSS sanitizer bypass in Pentestify report themes allows forced outbound requests
- State
- Published
- Severity
- 5.1 Medium
- Published
- Aug 19, 2026
- Updated
- Aug 21, 2026
- Reserved
- Aug 19, 2026
Description
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N | Secur0 |
Weaknesses
- CWE-180 Incorrect behavior order: validate before canonicalize
Affected Products
| Product | Versions |
|---|---|
Pentestifymaalfer |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.