Executive brief
Cotonti Siena, a content management system, contains a security flaw in its Personal File Space (PFS) module. An authenticated user can create a folder with a specially crafted name that includes malicious scripts. When other users or administrators view the list of folders, these scripts execute automatically in their browser, potentially allowing the attacker to steal session information or perform actions on behalf of the victim.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Cotonti Siena versions 0.9.26 and earlier. The vulnerability is located in 'pfs.main.php', where the 'ntitle' parameter is processed through a 'TXT' filter that fails to properly escape HTML tags before storing them in the database. An authenticated attacker with PFS access can inject arbitrary JavaScript by creating a folder with a malicious title. The payload executes when any user, including administrators, views the folder listing. While a sanitization mechanism exists in the codebase, it was reportedly found to be commented out in affected versions. No official patch has been released as of the disclosure date.
Affected products
- Cotonti Siena <= 0.9.26
Timeline
- 2026-06-06: other: Vulnerability discovered by researcher
- 2026-06-17: disclosed: Initial disclosure to Cotonti maintainers via GitHub Security Advisory
- 2026-07-09: advisory: CVE published to NVD dataset
- 2026-10-28: other: Public disclosure following 120-day vendor deadline expiry