Pentestify EUVD-2026-45947

Pentestify (CPE: cpe:2.3:a:maalfer:pentestify:*:*:*:*:*:*:*:*) is a web-based penetration testing report management tool built on a Python/FastAPI backend and a JavaScript frontend. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant, where attacker-controlled strings are persisted to a database and later rendered without sanitization. The root cause is dual: the backend schemas.py accepted arbitrary string values in the images and client_logo JSON array columns without allowlisting, and the frontend js/app.js used ES6 template literals to interpolate those values directly into img src attributes - for example, the literal string <img src="${img}"> - with no call to escapeHTML() or equivalent. The fix (commit a058a22) addresses both layers: schemas.py now enforces a strict data URL regex (^data:image/[a-zA-Z0-9.+-]+;base64,[A-Za-z0-9+/=\s]+$) via Pydantic field validators, the import path in main.py runs a post-import sanitization pass over existing database rows, and the three render functions in js/app.js now wrap each interpolated value in escapeHTML().