EUVD-2026-42739
GHSA-7h9c-8pxh-fg6v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered stored XSS requires low-privilege PFS account (PR:L) and victim browsing (UI:R); scope change to other users' sessions justifies S:C with limited C and I impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
1DescriptionCVE.org
Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users with PFS access to inject arbitrary script payloads by supplying malicious HTML in the ntitle parameter processed through the TXT filter in pfs.main.php. Attackers can create a folder with a crafted title containing script tags that are stored unescaped in the database and execute in the browser of any user who views the folder listing, including administrators.
AnalysisAI
Stored cross-site scripting in Cotonti Siena 0.9.26 and earlier allows any authenticated user with PFS (Personal File System) access to plant persistent JavaScript payloads by submitting a crafted folder title via the ntitle parameter. The TXT filter in pfs.main.php fails to sanitize HTML before persisting the value, so the payload executes in the browser of every subsequent visitor - including administrators - who views the folder listing. No public exploit has been confirmed beyond a researcher-published proof-of-concept gist, and no vendor patch has been identified at time of analysis.
Technical ContextAI
Cotonti Siena is a PHP-based content management and community platform. The vulnerability is rooted in pfs.main.php, the module handling the Personal File System feature, where the ntitle parameter (folder title supplied by the user) is passed through a 'TXT' filter that is expected to sanitize markup but fails to strip or encode script tags before writing the value to the database. This is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) defect: unsanitized user input is persisted and later reflected into an HTML context without output encoding. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) confirms the attack is network-reachable, requires low-privilege authentication, and demands passive victim interaction, consistent with a stored XSS pattern where the victim simply browses an affected page.
RemediationAI
No vendor-released patch has been identified at time of analysis; the reference points solely to a researcher gist with no corresponding Cotonti project release or commit. Site operators should monitor the official Cotonti repository for a fix targeting pfs.main.php output encoding of ntitle. As immediate compensating controls: restrict PFS access permissions to fully trusted administrator accounts only, which removes the PR:L attack surface entirely; deploy a strict Content Security Policy (CSP) header with script-src 'self' to limit execution of injected scripts, though this may affect legitimate CMS functionality and should be tested; and add server-side output encoding (htmlspecialchars with ENT_QUOTES) when rendering folder titles in HTML context. None of these workarounds address the root-cause storage of unescaped input, so code-level remediation remains necessary.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today