What’s Vulnerable › Vulnerabilities

CVE-2026-76203: CSS sanitizer bypass in Pentestify report themes allows forced outbound requests

• Severity: medium (CVSS 5.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-19 · updated 2026-09-01
• Weakness: CWE-180

Description

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist

Affected products

• maalfer Pentestify: from 1.2.0 before 1ed1aad — fixed in 1ed1aad

How to fix

Upgrade to a fixed version: maalfer Pentestify 1ed1aad. Check the vendor advisory for mitigations.

References

• https://github.com/ccyl13/Pentestify/commit/1ed1aadadb02e959af470aac9958462048f7f5f5
• https://secur0.com/en/cna/cve-list/cve-2026-76203-css-sanitizer-bypass-pentestify-report-themes

Get alerted when CVE-2026-76203 or the next vulnerability affects your stack