CVE-2026-58143: Cotonti Siena CSRF to Remote Code Execution in admin.php

CVE-2026-58143 · Severity: high · CVSS 8.8 · Published 2026-07-09

Cotonti Siena, a content management system, is vulnerable to an attack that allows unauthorized individuals to change website settings. By tricking a logged-in administrator into visiting a malicious link, an attacker can disable security filters and upload harmful files. This can lead to a complete takeover of the website, allowing attackers to steal data or disrupt operations.

Vendors: Cotonti.

Quick answers

Is CVE-2026-58143 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58143 being exploited in the wild.
How severe is CVE-2026-58143?
High severity, with a CVSS score of 8.8, published 9 July 2026.
Which products and versions are affected?
Cotonti Siena <= 0.9.26.
Is there a fix for CVE-2026-58143?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-58143 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-58143?
Check whether you run Cotonti Siena at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in Cotonti Siena versions 0.9.26 and earlier due to a lack of CSRF token validation in the 'admin.php' configuration update handler and the PFS module upload handler. An unauthenticated attacker can exploit this by tricking an authenticated administrator into submitting a forged POST request. This allows the attacker to modify system configurations, such as disabling the file extension blocklist (setting 'pfsfilecheck' to 0). Once the security filters are disabled, the attacker can use a second CSRF request to upload a malicious PHP script via the Personal File Space (PFS) module, resulting in remote code execution (RCE). As of the disclosure date, no official patch has been released by the vendor.

Affected products

  • Cotonti Siena <= 0.9.26

Timeline

  • 2026-06-06: other: Vulnerability discovered by researcher Saidakbarxon Maxsudxonov
  • 2026-06-17: other: Initial disclosure to Cotonti maintainers via GitHub Security Advisory
  • 2026-07-09: advisory: Public disclosure and CVE assignment by VulnCheck

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.