CVE-2026-59231CWE-918ssrf

CVE-2026-59231

published July 31, 2026

CVSS
5.3
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report client_logo field, which the server-side headless browser fetches while rendering the report.

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-07-31T20:17Z
References (3)
https://github.com/ccyl13/Pentestify/commit/a058a22b42c6311895622645265df79a60265b1d · 4daa8cea-433a-44bd-9456-53b127fc289ahttps://github.com/ccyl13/Pentestify/releases/tag/v1.1.1 · 4daa8cea-433a-44bd-9456-53b127fc289ahttps://secur0.com/en/cna/cve-list/cve-2026-59231-ssrf-in-pentestify-via-unvalidated-image-urls-cve-id-cve-2026-59231 · 4daa8cea-433a-44bd-9456-53b127fc289a
EPSS history
Timeline
  • 31 JUL 15:06Z
    Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs
    cvelistv5