CVE-2026-58143
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes the application's CSRF validation function. Attackers can disable the PFS module's file extension whitelist by setting pfsfilecheck to 0, enabling any user with PFS access to upload and execute arbitrary PHP files on the server.
Risk Assessment
The risk for the organization includes the possibility of full server compromise through remote code execution, which can lead to data theft, malware installation, or use of the server for further attacks.
Recommendation
It is recommended to immediately update Cotonti Siena to the latest available version that fixes this vulnerability and to implement CSRF protection mechanisms, such as synchronization tokens, in all administrative forms.
Other vulnerabilities in Cotonti Siena
Original NVD description (English source)
Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes the application's CSRF validation function. Attackers can disable the PFS module's file extension whitelist by setting pfsfilecheck to 0, enabling any user with PFS access to upload and execute arbitrary PHP files on the server.