Pentestify EUVD-2026-51545

Exploitation requires a valid authenticated Pentestify account (CVSS PR:L confirmed). The SSRF is triggered specifically during PDF report generation: the vulnerability activates when the backend headless browser renders a report whose finding images field or report client_logo field contains an attacker-supplied remote URL. Storing such a URL requires the ability to create or edit findings or report metadata, which is standard functionality available to any authenticated user - no administrative privilege is needed. Unauthenticated external parties cannot trigger the SSRF without valid credentials. The impact scope is bounded by the network egress context of the Pentestify server process. The CVSS vector confirms no user interaction is required beyond the authenticated user's own actions (UI:N), and the attack has no special environmental or timing requirements (AC:L, AT:N).

The CVSS 4.0 score of 5.3 Medium accurately reflects moderate but realistic risk. The attack vector is Network (AV:N) with low complexity (AC:L) and no specific attack requirements (AT:N), but exploitation is gated behind authenticated access (PR:L), meaningfully constraining the attacker pool to users who already hold valid Pentestify credentials. The subsequent-system impact metrics SC:L/SI:L indicate the SSRF can reach infrastructure beyond the application boundary - the primary danger is internal service probing, cloud metadata endpoint access (e.g., AWS IMDSv1 at 169.254.169.254), or pivoting to internal APIs that trust the server's IP. EPSS data was not provided; however, given the niche deployment footprint and the authentication prerequisite, opportunistic mass exploitation is unlikely. The vulnerability is not listed in CISA KEV and no public POC has been identified at time of analysis. Risk is highest in cloud-hosted deployments where the Pentestify server has unfiltered egress to internal metadata services or private network ranges. The authentication requirement is the primary limiting factor reducing real-world exploitability below what the network-reachable SSRF class would otherwise suggest.

An authenticated Pentestify user edits a pentest finding and sets an image URL to an internal target such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDSv1). When the PDF report is exported, the headless browser fetches that URL from the server's egress network context, and the response - potentially containing cloud IAM credentials - is embedded or observable via side-channel in the rendered output. The attacker can iteratively probe internal IP ranges through repeated PDF exports to enumerate accessible services. No public POC has been identified at time of analysis.