Executive brief
Cotonti is a content management system used to build and manage websites. A security flaw in its Personal File Storage module allows an attacker to trick a logged-in user into unknowingly performing actions on the site, such as changing folder names or descriptions. Most significantly, this could be used to change a private folder's settings to public, potentially exposing private files to the internet.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Cotonti 1.0.0 (specifically master branch commit f43f1fc3) within the Personal File Storage (PFS) module. The file 'modules/pfs/inc/pfs.editfolder.php' fails to implement anti-CSRF token validation (via the cot_check_xg() function) for the folder update action ('a=update'). An attacker can exploit this by luring an authenticated user to a malicious website that triggers a forged POST request to the victim's Cotonti instance. This allows the attacker to modify folder titles, descriptions, and visibility flags, potentially escalating the exposure of private data by marking folders as 'public'.
Affected products
- Cotonti Cotonti 1.0.0 (master branch commit f43f1fc3)
Timeline
- 2026-06-18: advisory: CVE published by NVD/TuranSec