Executive brief
Cotonti is a PHP content management framework used to build websites. Authenticated users with page creation or editing permissions can craft malicious redirects by prefixing page content with "redir:" and an arbitrary external URL. When visitors view these pages on the trusted Cotonti site, they are redirected to attacker-controlled domains, enabling phishing attacks and credential theft without requiring administrator access.
Technical details
The vulnerability is an unvalidated redirect in the page module (page.main.php) affecting Cotonti through version 1.0.0. Authenticated users with page edit permissions can inject redirect destinations prefixed with "redir:" in page bodies without validation of the target URL. An attacker with these privileges can host redirects on trusted domains to perform phishing attacks; exploitation requires authentication and user interaction (clicking the link).
Affected products
- Cotonti Cotonti through 1.0.0
Timeline
- 2026-09-18: disclosed: CVE-2026-93871 published