CVE-2026-76203 PUBLISHED

CSS sanitizer bypass in Pentestify report themes allows forced outbound requests

Assigner: Secur0
Reserved: 19.08.2026 Published: 19.08.2026 Updated: 19.08.2026

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
CVSS Score: 5.1

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	Low
Attack Complexity	Low	Integrity	Low	Integrity	Low
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	Low
User Interaction	Passive

CVSS 4.0

Product Status

Vendor	maalfer
Product	Pentestify
Versions	Default: unaffected affected from 1.2.0 to 1ed1aad (excl.)

Solutions

Tagged releases v2.0.0, v2.2.0, v2.3.0 and v2.3.2 shipped vulnerable. v1.1.1 is not affected (no custom_css field). The fix is not tagged and does not bump the version constant, so the upper bound cannot be stated as a version until a release is cut. It´s recommended to install from the repository.

Credits

Manuel Martínez Casasola finder
Xoán M. Otero Jorge analyst
Secur0 CNA coordinator
Mario Álvarez Fernández remediation developer

References

Problem Types

CWE-180 Incorrect behavior order: validate before canonicalize CWE

Impacts

CAPEC-267: Leverage Alternate Encoding