CVE-2026-76203

UNKNOWN 0.0

CSS sanitizer bypass in Pentestify report themes allows forced outbound requests

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist

CWE	CWE-180
Vendor	maalfer
Product	pentestify
Published	Aug 19, 2026

Stay Ahead of the Next One

Get instant alerts for maalfer pentestify

Be the first to know when new unknown vulnerabilities affecting maalfer pentestify are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

maalfer / Pentestify

1.2.0 < 1ed1aad

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ccyl13/Pentestify/commit/1ed1aadadb02e959af470aac9958462048f7f5f5 secur0.com: https://secur0.com/en/cna/cve-list/cve-2026-76203-css-sanitizer-bypass-pentestify-report-themes

Credits

Manuel Martínez Casasola Xoán M. Otero Jorge Secur0 CNA Mario Álvarez Fernández