CVE-2026-76203: CSS sanitizer bypass in Pentestify report themes allows forced outbound requests

Q: Who can exploit this issue, and who is exposed to the resulting request?

An authenticated Pentestify user who can supply report theme CSS can exploit it. Other users are exposed when their browsers render the affected report theme, causing outbound HTTP requests that disclose their IP address and User-Agent.

Q: What is required for exploitation?

The attacker needs an authenticated account and the ability to provide CSS in a report theme. They use CSS hex escapes to reconstruct the url() function and bypass the sanitizer's blocklist.

Q: Which versions are affected?

Maalfer Pentestify versions 1.2.0 through 2.3.2 are affected.

Published Aug 19, 2026

Updated

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist

Affected Software

1 affected component

Pentestify>=1.2.0<=2.3.2

Event History

Aug 19, 2026

CVE Published

via MITRE·02:23 PM

Data Sourced

via MITRE·02:23 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the resulting request?

An authenticated Pentestify user who can supply report theme CSS can exploit it. Other users are exposed when their browsers render the affected report theme, causing outbound HTTP requests that disclose their IP address and User-Agent.

What is required for exploitation?

The attacker needs an authenticated account and the ability to provide CSS in a report theme. They use CSS hex escapes to reconstruct the url() function and bypass the sanitizer's blocklist.

Which versions are affected?