CVE-2026-91939
CriticalCVSS 9.8Summary
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.
Risk Assessment
An attacker can execute arbitrary code on the server or modify database data, potentially leading to full application takeover. This may result in data leakage, destruction, or further lateral movement.
Recommendation
Update Cotonti to a version containing the fix or disable the Comments plugin until it is released. Additionally, restrict allowed_classes in unserialize() calls and implement input parameter validation.
Other vulnerabilities in Cotonti
See all- CVE-2026-55742Critical
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg to validate the anti-CSRF token.
- CVE-2026-55746High
Cotonti 1.0.0 is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title.
- CVE-2026-55745Medium
Cotonti 1.0.0 is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action ('a=update') updates folder metadata without calling cot_check_xg to validate the anti-CSRF token.
- CVE-2026-55744High
Cotonti 1.0.0 is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. The file upload action ('a=upload') processes uploaded files without calling cot_check_xg to validate the anti-CSRF token, even though sibling actions such as 'delete' do.
- CVE-2026-55741High
Cotonti 1.0.0 is vulnerable to Cross-Site Request Forgery in the administration configuration handler. The configuration update action ('a=update') processes POST data via cot_config_update_options without calling cot_check_xg to validate the anti-CSRF token (the 'x' parameter), unlike other admin handlers.
Original NVD description (English source)
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.