# CVE-2026-58144: Cotonti Siena stored XSS in PFS folder titles

Source: https://junglewise.ai/threats/cve-2026-58144-cotonti-siena-stored-xss-in-pfs-folder-titles  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-58144 · Severity: medium · CVSS 5.4 · Published 2026-07-09

Cotonti Siena, a content management system, contains a security flaw in its Personal File Space (PFS) module. An authenticated user can create a folder with a specially crafted name that includes malicious scripts. When other users or administrators view the list of folders, these scripts execute automatically in their browser, potentially allowing the attacker to steal session information or perform actions on behalf of the victim.

Vendors: [Cotonti](https://junglewise.ai/threats/vendors/cotonti).

## Quick answers

**Is CVE-2026-58144 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58144 being exploited in the wild.

**How severe is CVE-2026-58144?** Medium severity, with a CVSS score of 5.4, published 9 July 2026.

**Which products and versions are affected?** Cotonti Siena <= 0.9.26.

**Is there a fix for CVE-2026-58144?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-58144 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-58144?** Check whether you run Cotonti Siena at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Cotonti Siena versions 0.9.26 and earlier. The vulnerability is located in 'pfs.main.php', where the 'ntitle' parameter is processed through a 'TXT' filter that fails to properly escape HTML tags before storing them in the database. An authenticated attacker with PFS access can inject arbitrary JavaScript by creating a folder with a malicious title. The payload executes when any user, including administrators, views the folder listing. While a sanitization mechanism exists in the codebase, it was reportedly found to be commented out in affected versions. No official patch has been released as of the disclosure date.

## Affected products

- Cotonti Siena <= 0.9.26

## Timeline

- 2026-06-06: other: Vulnerability discovered by researcher
- 2026-06-17: disclosed: Initial disclosure to Cotonti maintainers via GitHub Security Advisory
- 2026-07-09: advisory: CVE published to NVD dataset
- 2026-10-28: other: Public disclosure following 120-day vendor deadline expiry

## References

- [https://gist.github.com/sermikr0/75686815e441c07462cfdea2fed5d305](https://gist.github.com/sermikr0/75686815e441c07462cfdea2fed5d305)

## Related threats

- [Cotonti Siena CSRF to Remote Code Execution in admin.php](https://junglewise.ai/threats/cve-2026-58143-cotonti-siena-csrf-to-remote-code-execution-in-admin-php)