Cotonti EUVD-2026-37855

Exploitation requires (1) the target Cotonti instance to have the Personal File Storage (PFS) module enabled and accessible at its standard entry point, (2) a victim who is currently authenticated to that Cotonti site, and (3) that victim to load attacker-controlled HTML in the same browser (UI:P - passive interaction such as clicking a link or viewing a page with an auto-submitting form). Limiting factors: the attack cannot succeed against logged-out users; modern browsers' default SameSite=Lax cookie behavior will block cross-site multipart POSTs unless the Cotonti session cookie explicitly sets SameSite=None; impact is confined to the individual victim's PFS area rather than global site state; and the attacker gains no direct shell - only the ability to write files the victim is permitted to upload, so further impact depends on whether uploaded content is later executed, served, or parsed unsafely.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N) yields a base score of 8.6 driven by network reach, low complexity, no attacker authentication, and high confidentiality/integrity impact on the user's PFS contents; the UI:P (passive user interaction) accurately reflects that the victim must visit a hostile page while logged in. PR:N is from the attacker's standpoint - Cotonti correctly notes the *victim* must be authenticated, which is intrinsic to CSRF and not a vector mismatch. No CISA KEV listing, no EPSS score, and no public exploit identified at time of analysis, so the realistic priority is moderate rather than emergency: exploitation requires social engineering of a logged-in Cotonti user, and impact is scoped to that user's PFS area unless chained with a downstream parser/RCE flaw. SSVC signals (automatable, technical impact) are not provided; the CISA-style 'automatable' assessment would lean yes because the forged request is deterministic, but the per-victim requirement caps blast radius.

An attacker publishes a webpage containing an auto-submitting HTML form that POSTs a multipart/form-data body with arbitrary file content to the target Cotonti site's pfs.php?a=upload endpoint. A logged-in Cotonti user is lured to the page (phishing link, malicious ad, forum embed); their browser silently attaches the session cookie and the upload completes, planting attacker-chosen files in the victim's PFS storage that can later be referenced, exhausted for quota abuse, or chained with any downstream file-handling weakness.