Cotonti EUVD-2026-37856

The victim must be authenticated to a Cotonti instance that has the PFS (Personal File Storage) module enabled - this module is not guaranteed to be active in all deployments, which limits the exploitable population. The attacker must know or guess a valid folder ID belonging to the victim, and must successfully lure the authenticated user into visiting an attacker-controlled page while their Cotonti session cookie remains valid (i.e., before session expiry or logout). Exploitation is strictly scoped to modifying folder metadata (title, description, public/gallery visibility flags) within the victim's own PFS - the attacker cannot read file contents directly, access other users' data, escalate privileges, or achieve remote code execution through this flaw. The primary limiting factor is the required user interaction (CVSS UI:R): without a successful social engineering step, the attack cannot proceed.

CVSS 3.1 scores this at 5.4 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. The network attack vector and low complexity are concerning, but the required user interaction (UI:R) is a meaningful real-world barrier - exploitation depends entirely on successfully luring an authenticated user to a malicious page while their session remains active. The confidentiality impact (C:L) arises indirectly: if an attacker forces a private folder to become public, files the user intended to keep private become accessible. No EPSS score was provided in the input, no KEV listing exists, and no confirmed POC exploit code is identified - these signals collectively suggest this is not under active exploitation at time of analysis. Real-world prioritization should be moderate: the impact ceiling is limited to folder metadata manipulation within a single user's PFS scope, not broader system compromise. The wildcard CPE version range is a gap - it cannot be confirmed from available data whether versions other than the named commit are affected.

An attacker crafts a hidden HTML form on a malicious webpage that auto-submits a POST request to the victim's Cotonti instance, targeting the PFS module's folder update endpoint with parameters that set the public flag to true on a specific folder ID. The attacker delivers a phishing link to a Cotonti user who is currently authenticated, and when that user's browser loads the malicious page, it silently submits the forged request, causing the victim's private folder - and any files within it - to become publicly accessible without any indication to the victim. No confirmed POC exploit code exists at time of analysis, but the vulnerability is mechanically straightforward to exploit given the publicly referenced code.