What is the CVSS score of EUVD-2026-53379?

EUVD-2026-53379 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Cotonti CMS are affected by EUVD-2026-53379?

Cotonti CMS Comments plugin allows any site member to inject and execute arbitrary code, compromising data integrity and potentially enabling complete system control.

How to fix or mitigate EUVD-2026-53379?

Within 24 hours: Disable the Cotonti Comments plugin and audit member account activity logs for suspicious base64-encoded POST submissions to the CreateAction.php and EditAction.php endpoints via the 'ci' and 'cb' parameters. Within 7 days: Monitor Cotonti's official security advisories for a vendor patch; if Comments functionality is not operationally essential, proceed with permanent plugin removal. Within 30 days: Apply any released security patch and upgrade Cotonti CMS to the patched version; conduct a comprehensive security review of member account access permissions and implement least-privilege access controls.

Cotonti CMS EUVD-2026-53379

| CVE-2026-71294 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-05 TuranSec

GHSA-rm37-v7mc-6795

PHP Deserialization Cotonti

7.6

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

vuln.today AI

7.6 HIGH

Network-reachable via HTTP POST with no special conditions, but PR:L is mandatory as member authentication is required; C:H reflects gadget-chain RCE potential beyond the confirmed SQL write.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 13:50 vuln.today

CVSS changed

Aug 05, 2026 - 13:37 NVD

7.7 (HIGH) 7.6 (HIGH)

CVE Published

Aug 05, 2026 - 12:38 cve.org

HIGH 7.6

DescriptionCVE.org

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a ci POST parameter obtained via cot_import('ci', 'P', 'TXT') (trim-only sanitization) is passed to unserialize(base64_decode($ci)) with no allowed_classes restriction, reachable by any member with write access to comments (the default Auth_members => 'RW' setting in plugins/comments/comments.setup.php). In plugins/comments/controllers/actions/EditAction.php, a cb parameter is similarly deserialized via unserialize(base64_decode($this->comeback)) in prepareComeBack(), reachable by any member editing their own comment. Because unserialize() is called without allowed_classes, an attacker can construct a serialized PHP object of any class loaded by Cotonti (a PHP Object Injection primitive). This was demonstrated in practice using Cotonti's own MySQL_cache class: a crafted serialized MySQL_cache object, once deserialized and later garbage-collected, triggers its __destruct()->flush() chain, causing an attacker-controlled INSERT INTO cot_cache with attacker-chosen row values - confirming genuine POP-chain exploitation, with further impact (including potential RCE) contingent on other gadget chains available in a given Cotonti installation's loaded classes. A third sink in DeleteAction.php contains the identical unserialize() pattern but is gated behind an admin-only authorization check and is not reachable by ordinary members.

AnalysisAI

PHP Object Injection in Cotonti CMS's Comments plugin grants any authenticated member a deserialization primitive reachable via two default-accessible sinks, with a working POP chain already demonstrated by the researcher. The ci POST parameter in CreateAction.php and the cb parameter in EditAction.php are both base64-decoded and passed to unserialize() without an allowed_classes restriction, allowing instantiation of any class loaded in the PHP runtime. A proof-of-concept using Cotonti's built-in MySQL_cache class was confirmed to trigger attacker-controlled SQL INSERT operations via __destruct()->flush(); further impact including RCE is contingent on additional gadget chains available in a given installation. No public exploit code has been released and no CISA KEV listing exists at time of analysis.

Technical ContextAI

Cotonti is an open-source PHP CMS (CPE: cpe:2.3:a:cotonti:cotonti:*:*:*:*:*:*:*:*, wildcard version range). CWE-502 (Deserialization of Untrusted Data) describes the root cause: PHP's native unserialize() function reconstructs arbitrary class instances from attacker-controlled input unless constrained via the allowed_classes parameter introduced in PHP 7.0. Without this argument, any class present in the running PHP process can be instantiated - the classic PHP Object Injection (POI) primitive. The first vulnerable sink is unserialize(base64_decode($ci)) in plugins/comments/controllers/actions/CreateAction.php, where the ci POST parameter is fetched via cot_import('ci', 'P', 'TXT') - a trim-only sanitization that does nothing to block a valid serialized string. The second is unserialize(base64_decode($this->comeback)) in EditAction.php's prepareComeBack() method. The demonstrated POP chain exploits MySQL_cache's __destruct()->flush() call sequence to reach an attacker-controlled INSERT INTO cot_cache. A structurally identical third sink in DeleteAction.php is gated behind an admin-only check and is not reachable by ordinary members.

RemediationAI

No vendor-released patched version has been identified at time of analysis; monitor https://github.com/Cotonti/Cotonti for upstream commits. The definitive code-level fix is to pass an explicit second argument to every unserialize() call in the Comments plugin: unserialize(base64_decode($ci), ['allowed_classes' => false]) blocks all object instantiation (and is appropriate if the data is expected to be a scalar or array), or supply a strict allowlist of safe classes if object deserialization is genuinely required by design. As a compensating control with functional trade-offs, administrators can change the Auth_members => 'RW' default in plugins/comments/comments.setup.php to restrict comment write access to a higher-trust group - this shrinks the attacker pool to accounts you explicitly trust, but alters site commenting behavior. Disabling the Comments plugin entirely eliminates exposure from both member-reachable sinks with no residual risk from those code paths. The DeleteAction.php sink is admin-gated and does not require emergency prioritization for non-admin accounts.