---
cve: "CVE-2026-76203"
severity: "MEDIUM"
cvss: 5.1
epss: "29%"
vendor: "maalfer"
kev: false
exploited: false
published: "2026-08-19 15:18:10"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-09-05T21:20:18+02:00"
---

# CVE-2026-76203

> 5.1 MEDIUM · 🧪 PoC

## Beschreibung

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer
in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound
HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via
CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |

## Patch verfügbar (OSV)

- 714e05ef7cfaf4d822193b8d18eacafbd89f5019 (Commit)

## Referenzen

- <https://github.com/ccyl13/Pentestify/commit/1ed1aadadb02e959af470aac9958462048f7f5f5>
- <https://secur0.com/en/cna/cve-list/cve-2026-76203-css-sanitizer-bypass-pentestify-report-themes>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-76203) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_