CVE-2026-59238: Stored XSS in Pentestify via unsanitized finding images and report client logo
Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's clientlogo array, which is interpolated into an <img> src attribute without escaping.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maalfer Pentestifyto a version that resolves this vulnerability.Fixed in 1.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59238?
CVE-2026-59238 has a medium severity rating of 6.9 according to the CVSS v4.0 scoring system.
How do I fix CVE-2026-59238?
To fix CVE-2026-59238, update to version 1.1.0 or later of maalfer Pentestify which addresses the stored XSS vulnerability.
What type of vulnerability is CVE-2026-59238?
CVE-2026-59238 is classified as a Stored Cross-site Scripting (XSS) vulnerability.
Can CVE-2026-59238 be exploited remotely?
Yes, CVE-2026-59238 can be exploited by a remote, authenticated attacker.
What impact does CVE-2026-59238 have on users?
CVE-2026-59238 allows an attacker to execute arbitrary JavaScript in the browser of any user who views the affected content.