CVE-2026-13150

Medium

Description

Server-Side Request Forgery (SSRF) (CWE-918) in the PDF generation endpoint GET /api/reports/{id}/pdf (backend/main.py) in ccyl13 Pentestify 1.0.0 and lower allows remote attackers to make the server issue requests to arbitrary internal or external URLs, including cloud metadata services, and return the rendered content in the resulting PDF via a crafted Host header, because the target URL is built from request.base_url without validation.

SeverityMedium

CVSS6.9

Exploit probability—

ProductPentestify

PublishedJun 24, 2026

First seenJun 24, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update

Pentestify Pentestify1.1.0 or later

Patches

github.com/ccyl13/Pentestify/commit/a058a22b42c6311895622645265df79a60265b1d

Affected products

Product	Affected versions	Fixed in
Pentestify Pentestify	v < 1.1.0	1.1.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.