Executive brief
Pentestify, a penetration testing reporting platform, is vulnerable to a security flaw where malicious code can be embedded in report images or logos. An attacker with access to the system can upload a specially crafted image path that, when viewed by another user or administrator, executes unauthorized commands in their web browser. This could lead to the theft of sensitive session information or unauthorized actions performed on behalf of the victim.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Pentestify's client-side rendering logic within js/app.js (specifically the renderPreview, renderEditor, and renderAuditData functions). The root cause is the lack of output encoding when interpolating values from the 'images' and 'client_logo' arrays into <img> tag 'src' attributes using template literals. While text fields are processed via an escapeHTML helper, these specific arrays are not. An authenticated attacker can inject a payload (e.g., breaking out of the src attribute with a quote and adding an 'onerror' handler) via the REST API or by importing a crafted database file. This results in arbitrary JavaScript execution in the context of any user viewing the affected report. The issue is fixed in version 1.1.0.
Affected products
- maalfer Pentestify before 1.1.0
Timeline
- 2026-06-23: patched: Fix committed in version 1.1.0
- 2026-07-20: disclosed: Vulnerability published by Secur0 CNA
- 2026-07-20: advisory: NVD record published