Is CVE-2026-59238 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59238 being exploited in the wild.

How severe is CVE-2026-59238?

Informational severity, with a CVSS score of 6.9, published 20 July 2026.

Which products and versions are affected?

maalfer Pentestify before 1.1.0.

Is there a fix for CVE-2026-59238?

A patch was published on 2026-06-23: Fix committed in version 1.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59238 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-59238?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59238: maalfer Pentestify stored XSS in report rendering functions

CVE-2026-59238 · Severity: info · CVSS 6.9 · Published 2026-07-20

Pentestify, a penetration testing reporting platform, is vulnerable to a security flaw where malicious code can be embedded in report images or logos. An attacker with access to the system can upload a specially crafted image path that, when viewed by another user or administrator, executes unauthorized commands in their web browser. This could lead to the theft of sensitive session information or unauthorized actions performed on behalf of the victim.

Quick answers

Is CVE-2026-59238 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59238 being exploited in the wild.
How severe is CVE-2026-59238?: Informational severity, with a CVSS score of 6.9, published 20 July 2026.
Which products and versions are affected?: maalfer Pentestify before 1.1.0.
Is there a fix for CVE-2026-59238?: A patch was published on 2026-06-23: Fix committed in version 1.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59238 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-59238?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Pentestify's client-side rendering logic within js/app.js (specifically the renderPreview, renderEditor, and renderAuditData functions). The root cause is the lack of output encoding when interpolating values from the 'images' and 'client_logo' arrays into <img> tag 'src' attributes using template literals. While text fields are processed via an escapeHTML helper, these specific arrays are not. An authenticated attacker can inject a payload (e.g., breaking out of the src attribute with a quote and adding an 'onerror' handler) via the REST API or by importing a crafted database file. This results in arbitrary JavaScript execution in the context of any user viewing the affected report. The issue is fixed in version 1.1.0.

Affected products

maalfer Pentestify before 1.1.0

Timeline

2026-06-23: patched: Fix committed in version 1.1.0
2026-07-20: disclosed: Vulnerability published by Secur0 CNA
2026-07-20: advisory: NVD record published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.