CVE-2026-59238 in Pentestify
Summary
by MITRE • 07/20/2026
Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's client_logo array, which is interpolated into an <img> src attribute without escaping.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability represents a classic stored cross-site scripting flaw that exists within the maalfer Pentestify application prior to version 1.1.0. The issue manifests in the client-side report rendering functions including renderPreview, renderEditor, and renderAuditData located in the js/app.js file. The vulnerability specifically occurs when user-supplied data from the images array of findings or the client_logo array of reports is interpolated directly into html src attributes without proper sanitization or escaping mechanisms. This allows an attacker to inject malicious javascript code that will execute whenever any user views the affected report, making it a persistent threat that can affect multiple victims over time.
The technical implementation of this vulnerability follows CWE-79 patterns where untrusted data flows through application logic into html output contexts without adequate input validation or output escaping. When attackers manipulate the images array or client_logo fields to include javascript payloads within the src attribute values, these scripts become executable in the browser context of any user who loads the vulnerable report. The attack requires only authentication to the system since the malicious code is stored server-side and executed client-side, making it particularly dangerous for environments where multiple users access shared reports. This vulnerability directly impacts the integrity and confidentiality of the application by allowing arbitrary code execution in user browsers.
The operational impact of this vulnerability extends beyond simple script execution as it can enable sophisticated attacks such as credential theft, session hijacking, or redirection to malicious domains. An attacker could craft payloads that steal cookies, capture keystrokes, or modify report content to mislead users about security findings. The persistence aspect of stored XSS means that once the malicious payload is injected, it will affect all users who view the report until the vulnerability is patched and the malicious data is removed from the system. This makes the vulnerability particularly dangerous in penetration testing environments where reports are frequently shared among team members and stakeholders.
Mitigation strategies for this vulnerability should focus on implementing proper input validation and output escaping mechanisms throughout the client-side rendering pipeline. All user-supplied data that gets interpolated into html attributes must be properly escaped or sanitized before being rendered to prevent script execution. The fix should include sanitizing the images array and client_logo values by removing or encoding potentially dangerous characters, particularly those used in javascript contexts such as quotes, semicolons, and script tags. Additionally, implementing content security policies that restrict script execution can provide defense-in-depth protection against exploitation attempts. Organizations should also consider regular security audits of client-side code to identify similar patterns and ensure proper input/output handling practices are consistently applied across the application.
The vulnerability aligns with several ATT&CK techniques including T1566.001 for credential access through malicious files and T1203 for exploitation for persistence. This classification reflects how the stored nature of the vulnerability allows attackers to maintain access over extended periods while also providing opportunities for further compromise through the execution of additional malicious payloads in user browsers. Proper patch management and secure coding practices are essential to prevent such vulnerabilities from being exploited in real-world scenarios where pentestify tools are used by security professionals handling sensitive information.