CVE-2026-55744
CVE-2026-55744 · Cotonti CSRF in PFS allows forced arbitrary file upload
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action ('a=upload') processes uploaded files without calling cot_check_xg to validate the anti-CSRF token, even though sibling actions such as 'delete' (line 272) do.
CVSS 8.6 · High · EPSS 0.1%
- Published
- Updated
Stack: php
Affected products and versions
cotonti
- Versions
- 1.0.0: Affected (semver)
No fix published
cotonti/cotonti Packagist
- Versions
- 0.9.23
- 0.9.24
- 0.9.24.1
- 0.9.24.2
- 0.9.25
- 1.0.0
- Affected ranges
- ECOSYSTEM: ≤ 1.0.0
No fix published