Cotonti CMS EUVD-2026-87379

Exploitation requires an administrator with an active, authenticated Cotonti session to visit an attacker-controlled page (or load an attacker-embedded image/link) while that session is valid; the targeted extensions-manager actions (install/update/pause/unpause) are admin-only functions, so a non-admin victim cannot be leveraged. The vulnerability exists because the extensions-manager endpoint performs state-changing operations without validating an anti-CSRF token (the cot_check_xg/cot_xg 'xk' token mechanism added in the fix). Limiting factors: success depends on victim user interaction (UI:P), an admin-privileged authenticated session in the browser, and same-session cookie delivery to the Cotonti host; there is no data-confidentiality exposure and no direct code execution from this issue alone.

This is a real but modest-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) scores 5.3 (Medium): network-reachable, low complexity, no attacker privileges, but requires passive user interaction (UI:P) - a logged-in administrator must visit an attacker-controlled page. Impact is limited to integrity and availability of the extension subsystem (VI:L/VA:L) with no confidentiality impact (VC:N), consistent with a CSRF that can install/update/pause/unpause extensions rather than directly read data. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so exploitation status is 'no public exploit identified at time of analysis'; there are no conflicting exploitation signals to reconcile. The one signal to weigh against the PR:N metric: although the attacker holds no credentials (correct for CSRF), successful exploitation is fully gated on an authenticated admin session plus a click, which meaningfully narrows real-world exploitability versus a raw unauthenticated RCE. The most important caveat is prevalence: Cotonti is a niche open-source PHP CMS, so even a working exploit has a small addressable population. Note also the referenced patch (PR #1908) is broad - it hardens redirect handling, output escaping, and adds anti-CSRF tokens (cot_check_xg/cot_xg) across forums and page modules, and tightens a .htaccess upload filter - indicating the fix bundles more than just the extensions-manager CSRF this CVE describes.

An attacker crafts a web page containing an auto-submitting form or embedded image that targets Cotonti's extensions-manager endpoint (system/admin/admin.extensions.php), which lacks anti-CSRF token validation. The attacker lures a currently-authenticated Cotonti administrator to view the page; the admin's browser silently issues the state-changing request, installing, updating, pausing, or unpausing an extension without consent. No public proof-of-concept is identified in the provided data, but the technique is trivial and low-complexity (AC:L).