What’s Vulnerable › Vulnerabilities

CVE-2026-59238: Stored XSS in Pentestify via unsanitized finding images and report client logo

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-20 · updated 2026-10-24
• Weakness: CWE-79

Description

Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's client_logo array, which is interpolated into an <img> src attribute without escaping.

Affected products

• maalfer Pentestify: before 1.1.0 — fixed in 1.1.0

How to fix

Upgrade to a fixed version: maalfer Pentestify 1.1.0. Check the vendor advisory for mitigations.

References

• https://github.com/maalfer/pentestify/commit/a058a22b42c6311895622645265df79a60265b1d
• https://secur0.com/en/cna/cve-list/cve-2026-59238-stored-xss-in-pentestify-via-unsanitized-finding-images-and-report-client-logo

Get alerted when CVE-2026-59238 or the next vulnerability affects your stack