CVE-2026-76203CWE-180

CVE-2026-76203

published August 19, 2026

CVSS
5.1
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer

in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound

HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via

CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist

The record
Technical detail
CVSS
5.1 · NONE
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00289 · 21.1th percentile
Weakness
CWE-180 · Incorrect Behavior Order: Validate Before Canonicalize
Published
2026-08-19T19:18Z
References (2)
https://github.com/ccyl13/Pentestify/commit/1ed1aadadb02e959af470aac9958462048f7f5f5 · 4daa8cea-433a-44bd-9456-53b127fc289ahttps://secur0.com/en/cna/cve-list/cve-2026-76203-css-sanitizer-bypass-pentestify-report-themes · 4daa8cea-433a-44bd-9456-53b127fc289a
EPSS history
Timeline
  • 19 AUG 14:23Z
    CSS sanitizer bypass in Pentestify report themes allows forced outbound requests
    cvelistv5