CVE-2026-59238 is a stored cross-site scripting vulnerability in maalfer Pentestify versions prior to 1.1.0. The vulnerability is located in the client-side report rendering functions renderPreview, renderEditor, and renderAuditData within js/app.js. An attacker with authentication can inject malicious JavaScript via the images array of a finding or the client_logo array of a report. This data is then interpolated directly into an <img> src attribute without proper escaping, leading to script execution in the context of any user viewing the report. The vulnerability is classified as CWE-79. There is no vendor advisory or patch information available to confirm remediation status.

An authenticated remote attacker can execute arbitrary JavaScript in the browsers of users who view affected reports. This can lead to session hijacking, unauthorized actions, or other malicious activities within the context of the vulnerable application. The vulnerability affects the confidentiality and integrity of user sessions when viewing reports containing crafted payloads.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to report creation and editing to trusted users only, and consider sanitizing or validating inputs that populate the images and client_logo arrays to prevent injection of malicious scripts.