EUVD-2026-37856
GHSA-hp3v-wp32-953h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered CSRF requires passive user interaction (UI:R); attacker needs no privileges; integrity impact is folder metadata only; confidentiality impact reflects indirect exposure of files in a newly-public folder.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action ('a=update') updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg() to validate the anti-CSRF token. A remote attacker who lures an authenticated user into visiting a malicious page can force the browser to submit a forged request that modifies the victim's folder metadata, including making a private folder public.
AnalysisAI
Cross-site request forgery in Cotonti 1.0.0's Personal File Storage module allows remote attackers to hijack authenticated user sessions to silently modify folder metadata. The folder update action ('a=update') in modules/pfs/inc/pfs.editfolder.php processes state-changing requests without invoking Cotonti's built-in anti-CSRF token validation function cot_check_xg(), enabling an attacker to force a logged-in user to unknowingly expose private folders or alter their descriptions. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV, but the specific vulnerable code commit is publicly identified by the reporter TuranSec.
Technical ContextAI
Cotonti is a PHP-based CMS/framework. The PFS (Personal File Storage) module provides per-user file folder management, and pfs.editfolder.php handles folder CRUD operations. At line 90 of that file (commit f43f1fc38ba4e02027786dad9dac1435c7c52b30), the 'a=update' branch updates folder title, description, and visibility flags (public/gallery) without calling cot_check_xg(), which is Cotonti's framework-level mechanism for verifying the synchronizer token pattern against CSRF attacks. CWE-352 (Cross-Site Request Forgery) describes exactly this root cause: a state-changing server-side action that accepts requests without an unpredictable, session-bound token, allowing a third-party origin to forge those requests on behalf of an authenticated user. CPE cpe:2.3:a:cotonti:cotonti:*:*:*:*:*:*:*:* uses a wildcard version range, suggesting the flaw may not be limited to 1.0.0 alone, though only the specific commit is directly confirmed.
RemediationAI
No vendor-released patched version has been identified from the available data - the provided references link only to the vulnerable source file and the upstream GitHub repository, not to a fix commit, advisory, or tagged release. The correct fix is to add a cot_check_xg() call within the 'a=update' branch of modules/pfs/inc/pfs.editfolder.php (at approximately line 90), consistent with how anti-CSRF protection is applied elsewhere in the Cotonti framework. Administrators unable to patch immediately should consider disabling the PFS module entirely if it is not in active use, which eliminates the attack surface at the cost of losing file storage functionality. Restricting access to Cotonti instances via network controls (e.g., IP allowlists or VPN) reduces exposure by limiting the pool of users who could be lured to attacker-controlled pages. Users should be advised not to click unverified links while logged into Cotonti. Monitor the upstream repository at https://github.com/Cotonti/Cotonti for a fix commit targeting this code path.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today