CSS sanitizer bypass in Pentestify report themes allows forced outbound requests
Summary
| CVE | CVE-2026-76203 |
|---|---|
| State | PUBLISHED |
| Assigner | Secur0 |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-19 15:18:10 UTC |
| Updated | 2026-08-19 15:18:10 UTC |
| Description | Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist |
Risk And Classification
Primary CVSS: v4.0 5.1 MEDIUM from 4daa8cea-433a-44bd-9456-53b127fc289a
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-180 | CWE-180 CWE-180 Incorrect behavior order: validate before canonicalize
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 4daa8cea-433a-44bd-9456-53b127fc289a | Secondary | 5.1 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 5.1 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Maalfer | Pentestify | affected 1.2.0 1ed1aad custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/ccyl13/Pentestify/commit/1ed1aadadb02e959af470aac9958462048f7... | 4daa8cea-433a-44bd-9456-53b127fc289a | github.com | |
| secur0.com/en/cna/cve-list/cve-2026-76203-css-sanitizer-bypass-pentestif... | 4daa8cea-433a-44bd-9456-53b127fc289a | secur0.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Manuel Martínez Casasola (en)
CNA: Xoán M. Otero Jorge (en)
CNA: Secur0 CNA (en)
CNA: Mario Álvarez Fernández (en)
Additional Advisory Data
Solutions
CNA: Tagged releases v2.0.0, v2.2.0, v2.3.0 and v2.3.2 shipped vulnerable. v1.1.1 is not affected (no custom_css field). The fix is not tagged and does not bump the version constant, so the upper bound cannot be stated as a version until a release is cut. It´s recommended to install from the repository.