{"id":"CVE-2026-59238","summary":"Stored XSS in Pentestify via unsanitized finding images and report client logo","details":"Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's client_logo array, which is interpolated into an \u003cimg\u003e src attribute without escaping.","modified":"2026-07-25T03:56:44.663967833Z","published":"2026-07-20T13:58:01.643Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59238.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"fixed":"1.1.0"}]},{"extracted_events":[{"fixed":"1.1.0"}],"source":"CPE_FIELD"},{"extracted_events":[{"fixed":"1.1.0"}],"source":"DESCRIPTION"}],"cna_assigner":"Secur0","cwe_ids":["CWE-79"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59238.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59238"},{"type":"FIX","url":"https://github.com/maalfer/pentestify/commit/a058a22b42c6311895622645265df79a60265b1d"},{"type":"PACKAGE","url":"https://github.com/maalfer/pentestify"},{"type":"ARTICLE","url":"https://secur0.com/en/cna/cve-list/cve-2026-59238-stored-xss-in-pentestify-via-unsanitized-finding-images-and-report-client-logo"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/maalfer/pentestify","events":[{"introduced":"0"},{"fixed":"a058a22b42c6311895622645265df79a60265b1d"}],"database_specific":{"source":"REFERENCES"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59238.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}]}