GitHub Advisoryadvisory · Packagist

GHSA-hp3v-wp32-953h Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module

MEDIUM Published 2026-06-18 Modified 2026-06-19 Official page ↗
Aliases
CVE-2026-55745
Ecosystem
Packagist
Packages
cotonti/cotonti
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-352
Reviewed
2026-06-19

Affected packages

• Packagist cotonti/cotonti: <= 1.0.0 (no fix yet)

Description

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action ('a=update') updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg() to validate the anti-CSRF token. A remote attacker who lures an authenticated user into visiting a malicious page can force the browser to submit a forged request that modifies the victim's folder metadata, including making a private folder public.

Related

Alias · CVE (1)

  • CVE-2026-55745 Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References