Which versions of Cotonti are affected by CVE-2026-55744?

Cotonti 1.0.0 contains a Cross-Site Request Forgery vulnerability in its Personal File Storage module that allows attackers to trick authenticated users into uploading arbitrary files to their…

How to fix or mitigate CVE-2026-55744?

Within 24 hours: Audit all systems running Cotonti 1.0.0 and disable the Personal File Storage upload function if operationally feasible. Within 7 days: Deploy Web Application Firewall (WAF) rules to enforce CSRF token validation on /modules/pfs/inc/pfs.main.php?a=upload endpoints and restrict file uploads to whitelisted MIME types. Within 30 days: Contact Cotonti vendor for estimated patch release date; if unavailable, plan migration to an alternative file storage solution with confirmed CSRF protections or upgrade to a patched version when released.

Cotonti CVE-2026-55744

Q: What is the CVSS score of CVE-2026-55744?

CVE-2026-55744 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-37855 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-18 TuranSec

GHSA-wx35-cv59-9gwr

PHP CSRF File Upload Cotonti

8.6

CVSS 4.0 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network-reachable forged POST, no attacker auth (PR:N), victim must click/visit (UI:R); high integrity from arbitrary file write to victim PFS, low confidentiality (uploaded content may be retrievable), no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Jun 18, 2026 - 08:45 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 18, 2026 - 08:37 vuln.today

cvss_changed

CVSS changed

Jun 18, 2026 - 08:37 NVD

8.1 (HIGH) 8.6 (HIGH)

Analysis Generated

Jun 18, 2026 - 08:02 vuln.today

DescriptionCVE.org

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action ('a=upload') processes uploaded files without calling cot_check_xg() to validate the anti-CSRF token, even though sibling actions such as 'delete' (line 272) do. A remote attacker who lures an authenticated user into visiting a malicious page can force the browser to submit a forged multipart request that uploads arbitrary files into the victim's PFS storage.

AnalysisAI

Cross-Site Request Forgery in the Personal File Storage (PFS) module of Cotonti 1.0.0 (commit f43f1fc3) allows remote attackers to upload arbitrary files into an authenticated victim's storage by luring them to a malicious page. The 'a=upload' action in modules/pfs/inc/pfs.main.php omits the cot_check_xg() anti-CSRF token check that sibling actions like 'delete' enforce. No public exploit identified at time of analysis, though the root cause is documented in the public source code reference.

Technical ContextAI

Cotonti is an open-source PHP-based content management framework. The flaw sits in its Personal File Storage (PFS) module, a per-user file area whose entry point modules/pfs/inc/pfs.main.php dispatches actions via the 'a' query parameter. Cotonti centralizes CSRF protection through the cot_check_xg() helper, which validates a per-session 'x' token; the 'delete' action invokes it (line 272) but the 'upload' branch (referenced near line 118) does not, so multipart POSTs ride solely on the victim's session cookie. This is a textbook CWE-352 (Cross-Site Request Forgery) instance - a state-changing handler that trusts ambient browser credentials without verifying request provenance.

RemediationAI

No vendor-released patch identified at time of analysis - references point only to the vulnerable source file and the project repository, not to a tagged fix release. The minimal upstream remediation is to add a cot_check_xg() (or equivalent token validation) call at the top of the 'a=upload' branch in modules/pfs/inc/pfs.main.php, mirroring the existing guard on the 'delete' action at line 272; operators comfortable patching PHP can apply this change locally pending an official release. As compensating controls until a vendor fix lands, administrators can restrict the PFS module to trusted authenticated users via existing Cotonti permission groups (reduces attacker pool but does not eliminate the bug), enforce a strict SameSite=Lax or Strict cookie attribute on the Cotonti session cookie at the PHP or reverse-proxy layer (breaks cross-site multipart POSTs but may interfere with legitimate cross-origin embeds), or front the site with a WAF rule that requires a Referer/Origin matching the Cotonti host for /pfs.php?a=upload requests (low side effects but bypassable if Referer is suppressed). Monitor https://github.com/Cotonti/Cotonti for an upstream commit and apply once tagged.