Cotonti CMS CVE-2026-93871

Requires an authenticated Cotonti account that holds page creation or edit permissions (PR:L) - anonymous users cannot exploit it. The attacker must place an external URL in a page body using the redir: prefix (the specific product feature at fault, in modules/page/inc/page.main.php). Exploitation further depends on a victim actually visiting/clicking the crafted page (UI:P), and affects Cotonti versions through 1.0.0 running without the PR #1901 fix. Impact is confined to redirecting visitors for phishing; no server-side code execution or data compromise. These preconditions (needed account privilege plus required victim interaction) meaningfully limit real-world risk below the raw CVSS number.

This is a genuine but low-severity stored open redirect (CWE-601) confirmed by both the vendor advisory (VulnCheck) and a source-verified patch (PR #1901 adds a cot_url_check guard against external http/ftp destinations). The vendor CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N) accurately reflects the real risk: exploitation is network-reachable but requires an authenticated account holding page create/edit permissions (PR:L) and, critically, a victim must click/visit the crafted page (UI:P). No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' There are no conflicting signals - description, CVSS vector, CWE, and patch diff are mutually consistent. The impact is limited to phishing facilitation (abusing the trusted domain's reputation to redirect victims); there is no direct confidentiality or integrity compromise of the Cotonti server itself. Net: a real, patch-worthy issue but a low priority - the authentication precondition plus required victim interaction sharply limit weaponizability, and the affected product has a small deployment footprint.

An authenticated Cotonti user with page creation/edit rights creates a page whose body uses the redir: prefix pointing at an attacker-controlled external host. The attacker distributes the link to this legitimate-looking page on the trusted Cotonti domain; when a victim opens it, they are silently redirected to a phishing or malware site. No public exploit code is identified, but the technique is trivial once the account requirement is met.