PT-2026-50646 · Cotonti · Cotonti

Publicado 2026-06-18 · Atualizado 2026-06-18 · CVE-2026-55746

Mitre

CVSS v3.1

7.6

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot import is disabled), so an authenticated user can store HTML/JavaScript in a folder title. In modules/pfs/inc/pfs.main.php the title is assigned to the template variable PFF ROW TITLE without htmlspecialchars(), and modules/pfs/tpl/pfs.tpl outputs {PFF ROW TITLE} unescaped. When the folder listing is viewed (including by other users for public folders), the injected script executes in the victim's browser.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-55746

Produtos afetados

Cotonti

Referências · 2

• https://github.com/Cotonti/Cotonti · Nota
• https://github.com/Cotonti/Cotonti/blob/f43f1fc38ba4e02027786dad9dac1435c7c52b30/modules/pfs/inc/pfs.main.php#L396 · Nota