Executive brief
Cotonti is a PHP content management framework used to build websites and online applications. A vulnerability in its comments plugin allows authenticated users with comment editing permissions to instantiate arbitrary PHP objects through a base64-encoded parameter, potentially leading to unauthorized file modification or remote code execution on the affected server.
Technical details
The vulnerability exists in the comments plugin's EditAction controller, which passes a base64-decoded parameter directly to PHP's unserialize() function without restricting object instantiation through the allowed_classes parameter. An authenticated attacker with comment write permissions can craft a malicious serialized payload to trigger gadget chain exploitation, resulting in file write or arbitrary code execution.
Affected products
- Cotonti Cotonti 1.0.0
Timeline
- 2026-09-18: disclosed