CVE-2026-13150

MEDIUM

SSRF in Pentestify PDF generation endpoint via Host header

Title source: cna

Description

Server-Side Request Forgery (SSRF) (CWE-918) in the PDF generation endpoint GET /api/reports/{id}/pdf (backend/main.py) in ccyl13 Pentestify 1.0.0 and lower allows remote attackers to make the server issue requests to arbitrary internal or external URLs, including cloud metadata services, and return the rendered content in the resulting PDF via a crafted Host header, because the target URL is built from request.base_url without validation.

References (1)

Core 1

Core References

Patch patch

https://github.com/ccyl13/Pentestify/commit/a058a22b42c6311895622645265df79a60265b1d

View Patch ZIP pw:eip

Scores

CVSS v4 6.9

EPSS 0.0029

EPSS Percentile 20.9%

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-918

Status published

Products (1)

Pentestify/Pentestify < 1.1.0

Published Jun 24, 2026

Tracked Since Jun 24, 2026