CVE-2026-55745
CVE-2026-55745 · Cotonti CSRF in PFS folder edit allows unauthorized folder modification
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action ('a=update') updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg to validate the anti-CSRF token.
CVSS 5.3 · Medium · EPSS 0.1%
- Published
- Updated
Stack: php
Affected products and versions
cotonti
- Versions
- 1.0.0: Affected (semver)
No fix published
cotonti/cotonti Packagist
- Versions
- 0.9.23
- 0.9.24
- 0.9.24.1
- 0.9.24.2
- 0.9.25
- 1.0.0
- Affected ranges
- ECOSYSTEM: ≤ 1.0.0
No fix published