CVE-2026-76203— CSS sanitizer bypass in Pentestify report themes allows forced outbound requests
Quick assessment
Affected
maalfer Pentestify
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 maalfer Pentestify 1.2.0 至 2.3.2 版本中，报告主题 CSS 清理器（CSS sanitizer）存在“验证前未进行规范化处理”（Validate Before Canonicalize）的错误行为顺序问题。该漏洞允许已认证用户通过 CSS 十六进制转义序列重构 函数，从而绕过清理器的黑名单过滤机制，强制其他用户的浏览器发起出站 HTTP 请求，导致这些用户的 IP 地址和用户代理（User-Agent）信息泄露。
Possible ATT&CK Techniques 3 AI
T1005 · Data from Local System T1583 · Acquire Infrastructure T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| maalfer | Pentestify | 1.2.0< 1ed1aad |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76203
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CSS sanitizer bypass in Pentestify report themes allows forced outbound requests
Source: CVE Program / CVE List V5
Vulnerability Description
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer
in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound
HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via
CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不正确的行为次序：规范化之前验证
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| maalfer | Pentestify | 1.2.0 ~ 1ed1aad | - |
|
II. Public POCs for CVE-2026-76203
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76203
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-76203 (1)
Vendor Advisories for CVE-2026-76203 (1)
IV. Related Vulnerabilities
Same product: Pentestify
-
CVE-2026-19744
Stored Cross-site Scripting in Pentestify Markdown renderer -
CVE-2026-19716
Stored Cross-site Scripting in Pentestify user account delet -
CVE-2026-19434
Stored Cross-site Scripting in Pentestify finding severity f -
CVE-2026-59231
Server-Side Request Forgery in Pentestify PDF export via unv -
CVE-2026-59238
Stored XSS in Pentestify via unsanitized finding images and
Same vendor: maalfer
-
CVE-2026-75872
HTML Injection in MailerUp double opt-in verification email -
CVE-2026-19744
Stored Cross-site Scripting in Pentestify Markdown renderer -
CVE-2026-19716
Stored Cross-site Scripting in Pentestify user account delet -
CVE-2026-19434
Stored Cross-site Scripting in Pentestify finding severity f -
CVE-2026-59238
Stored XSS in Pentestify via unsanitized finding images and
Same weakness: CWE-180
-
CVE-2026-73420
NextAuth.js: Email normalizer validates the address before U -
CVE-2026-72917
AnythingLLM: Password recovery accepts one recovery code twi -
CVE-2026-69246
Guzzle: Noncanonical host can bypass host-based checks -
CVE-2026-69245
Guzzle: Noncanonical cookie domain keeps subdomain scope -
CVE-2026-7120
@fastify/static vulnerable to Authorization Bypass via Non-C
V. Comments for CVE-2026-76203
No comments yet