Cotonti CMS EUVD-2026-83366

Requires a reachable redirect caller such as the ratings plugin (plugins/ratings/ratings.ajax.php) that passes user-supplied destinations through the flawed cot_url_check() in system/functions.php. The attacker must supply a hostname that begins with the legitimate site domain (e.g. sitedomain.attacker.com) to satisfy the unanchored regex. Exploitation is LIMITED by required victim interaction (UI:P - a user must click the malicious link) and delivers only redirection to an attacker host, not direct compromise; affects Cotonti through version 1.0.0 in default configuration.

This is a genuinely low-severity issue whose signals are internally consistent rather than conflicting. The vendor CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N) correctly captures an open redirect: network-reachable and unauthenticated to stage, but requiring victim interaction (UI:P - a user must click the crafted link) and yielding only low confidentiality/integrity impact via subsequent-system effects (SC:L/SI:L). No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is: no public exploit identified at time of analysis. There is no signal conflict - the description (regex lacking an end-of-string anchor, exploitable through the ratings plugin) matches the CVSS vector and the confirmed patch (PR#1899 adds an end-anchor). The only real risk is phishing/credential-harvesting leverage from abusing a trusted domain; there is no code execution or data exposure. Priority is low: this is a defense-in-depth hardening fix, not an emergency, especially given the niche deployment footprint.

An attacker crafts a URL to a Cotonti site's redirect caller (e.g., the ratings plugin) with a redirect target like https://victimdomain.attacker.com, which passes the unanchored regex because it begins with the site's scheme and domain prefix. The attacker distributes this link (phishing email, forum post); when a user clicks it, they are silently redirected from the trusted Cotonti host to the attacker-controlled site for phishing or malware delivery. No public exploit code is identified, but the source-code diff makes the bypass trivially reproducible.