CVE-2026-55746
CVE-2026-55746 · Cotonti stored XSS via PFS folder title
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title.
CVSS 7.0 · High · EPSS 0.2%
- Published
- Updated
Stack: php
Affected products and versions
cotonti
- Versions
- 1.0.0: Affected (semver)
No fix published
cotonti/cotonti Packagist
- Versions
- 0.9.23
- 0.9.24
- 0.9.24.1
- 0.9.24.2
- 0.9.25
- 1.0.0
- Affected ranges
- ECOSYSTEM: ≤ 1.0.0
No fix published