Which versions of Cotonti are affected by CVE-2026-55746?

Cotonti 1.0.0 file storage system allows authenticated users to inject malicious code into shared folders, which executes when other employees view them.

How to fix or mitigate CVE-2026-55746?

Within 24 hours: Audit all Cotonti 1.0.0 deployments and identify Personal File Storage usage with public folder access. Within 7 days: Disable PFS feature if not business-critical; if required, restrict public folder viewing to authenticated users and log all folder creation/modification events. Within 30 days: Monitor vendor communications for patch release; if unavailable, maintain access controls as permanent baseline and evaluate alternative file-sharing solutions.

Cotonti CVE-2026-55746

Q: What is the CVSS score of CVE-2026-55746?

CVE-2026-55746 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-37858 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-18 TuranSec

GHSA-86hp-hf3j-3m8r

PHP XSS Cotonti

7.0

CVSS 4.0 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable PFS module exploitable by any authenticated low-priv user (PR:L); victim must view the folder listing (UI:R); payload executes in another user's browser context (S:C) with limited C/I impact and no availability effect.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Jun 18, 2026 - 08:44 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 18, 2026 - 08:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 18, 2026 - 08:37 vuln.today

cvss_changed

CVSS changed

Jun 18, 2026 - 08:37 NVD

7.6 (HIGH) 7.0 (HIGH)

Analysis Generated

Jun 18, 2026 - 08:03 vuln.today

DescriptionCVE.org

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title. In modules/pfs/inc/pfs.main.php the title is assigned to the template variable PFF_ROW_TITLE without htmlspecialchars(), and modules/pfs/tpl/pfs.tpl outputs {PFF_ROW_TITLE} unescaped. When the folder listing is viewed (including by other users for public folders), the injected script executes in the victim's browser.

AnalysisAI

Stored cross-site scripting in Cotonti 1.0.0 (master branch, commit f43f1fc3) lets an authenticated user inject HTML/JavaScript into Personal File Storage (PFS) folder titles, which then execute in any viewer's browser when the folder listing is rendered. The flaw stems from the 'TXT' import filter not encoding HTML combined with unescaped template output, and no public exploit identified at time of analysis. Discovered by TuranSec; impact extends to other users browsing public folders, enabling session theft or account actions in their context.

Technical ContextAI

Cotonti is an open-source PHP-based content management and community platform. The vulnerability lives in the Personal File Storage (PFS) module: the folder title field (pff_title) is processed through cot_import() using the 'TXT' filter, which intentionally omits HTML tag stripping/encoding (the tag check is disabled for this filter). The raw value is then assigned to template variable PFF_ROW_TITLE in modules/pfs/inc/pfs.main.php without htmlspecialchars(), and modules/pfs/tpl/pfs.tpl emits {PFF_ROW_TITLE} unescaped. This is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) caused by trusting an input filter that does not actually sanitize HTML and by missing contextual output encoding at the template layer. CPE coverage (cpe:2.3:a:cotonti:cotonti:*) implies all versions matching the vulnerable code path are in scope until a fix lands.

RemediationAI

No vendor-released patch identified at time of analysis; monitor the upstream repository (https://github.com/Cotonti/Cotonti) for a fix to modules/pfs/inc/pfs.main.php and modules/pfs/tpl/pfs.tpl. Pending an official release, operators should apply a local patch wrapping PFF_ROW_TITLE assignment with htmlspecialchars($pff_title, ENT_QUOTES, 'UTF-8') before assigning to the template, or switch the cot_import filter for pff_title from 'TXT' to a stricter HTML-stripping filter - both changes risk breaking any legitimate use of formatting characters in folder titles but are safe for the typical use case. Compensating controls include restricting PFS folder creation to trusted user groups via Cotonti's permission system, disabling public folders so titles are only rendered to the owner, and deploying a Content-Security-Policy header that forbids inline script (script-src 'self') which neutralizes most XSS payloads at the cost of breaking any inline scripts in custom themes.