CVE-2026-59231
Received Received - Intake

Server-Side Request Forgery in Pentestify PDF Export

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: 4daa8cea-433a-44bd-9456-53b127fc289a

Description
Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report client_logo field, which the server-side headless browser fetches while rendering the report.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-59231
EUVD
EUVD-2026-51545

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
maalfer pentestify to 1.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the PDF export feature of maalfer Pentestify before version 1.1.0. It allows authenticated users to make the server send outbound HTTP GET requests to any destination chosen by the attacker. This happens because the server does not properly validate URLs stored in the finding images field or the report client_logo field, which the server-side headless browser fetches while generating the PDF report.

Detection Guidance

Detecting this SSRF vulnerability requires checking for unvalidated URLs in the finding images field or report client_logo field in maalfer Pentestify before version 1.1.0. Inspect server logs for outbound HTTP GET requests to unusual destinations during PDF export operations.

Impact Analysis

An attacker with authenticated access could exploit this to send requests to internal systems, potentially accessing sensitive data or services. This could lead to data breaches, unauthorized access to internal resources, or even further attacks against other systems within your network.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using this software may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade maalfer Pentestify to version 1.1.0 or later. Validate and sanitize all URLs in the finding images and client_logo fields before processing. Restrict outbound network access from the server to only necessary destinations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59231. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart