CVE-2026-55744: Cotonti 1.0.0 CSRF in Personal File Storage Upload

Technical summary

The vulnerability resides in modules/pfs/inc/pfs.main.php within Cotonti 1.0.0 (master branch, commit f43f1fc3). The file upload action handler ('a=upload') processes multipart form data and writes files to the victim's Personal File Storage without invoking cot_check_xg(), the framework's CSRF token validation function. This is inconsistent with other PFS actions like 'delete' (line 272), which properly call the validation function. An attacker exploits this by hosting a page with an embedded multipart form that targets the vulnerable upload endpoint; when an authenticated user visits the attacker's page, their browser automatically submits the forged request using their existing session cookies, resulting in arbitrary file uploads.

Business impact

This vulnerability undermines the integrity of user file storage and can lead to unauthorized modifications of a user's PFS directory. While confidentiality is not directly compromised, the ability to upload arbitrary files could enable secondary attacks—such as uploading malicious scripts that might be executed if the PFS directory is web-accessible, or filling storage quotas to cause denial of service. For organizations deploying Cotonti, this represents a risk to user trust and data integrity within the platform.

Affected systems

Cotonti version 1.0.0, specifically the master branch at commit f43f1fc3, is affected. The vulnerability is isolated to the Personal File Storage (PFS) module. Organizations running this version, or versions derived from this commit, should treat this as applicable to their deployment.

Exploitability

Exploitation requires user interaction and authentication. An attacker must convince a user who is already logged into Cotonti to visit a malicious webpage; the attacker then leverages the user's active session to trigger the forged upload. No special privileges or complex attack chain is required beyond basic HTML and form submission. The CVSS 3.1 score of 8.1 (HIGH) reflects the combination of network-based delivery, relatively low complexity, and the need for user interaction, balanced against the absence of confidentiality impact.

Remediation

The fix requires modifying modules/pfs/inc/pfs.main.php to add a call to cot_check_xg() in the upload action handler, consistent with how other PFS actions validate CSRF tokens. Verify against the vendor advisory or repository for the exact patch location and implementation. This is a straightforward code change that should be prioritized in the next maintenance release.

Patch guidance

Check the Cotonti repository and official vendor advisories for available patches. Given this is reported against version 1.0.0, newer versions or branches may already include the fix. If you are running the master branch or a downstream version, apply the CSRF token validation to the upload handler immediately. If no official patch is available yet, consider temporarily disabling the PFS upload feature or restricting access to the PFS module until a fix is released.

Detection guidance

Monitor HTTP logs for unusual POST requests to modules/pfs/inc/pfs.main.php with a=upload parameter, especially those originating from external referrers or lacking expected HTTP_REFERER headers. Track file uploads to user PFS directories and correlate them with user session activity—unexpected uploads during periods when the user was not actively using the platform may indicate CSRF exploitation. Web application firewalls can be configured to require CSRF token validation on upload endpoints.

Why prioritize this

Despite being HIGH severity, this vulnerability requires active user interaction and a pre-existing authenticated session, which somewhat limits opportunistic exploitation. However, the ease of crafting a CSRF payload and the potential for data integrity compromise warrant prompt patching. If your organization uses Cotonti in a multi-tenant or collaborative environment, the risk is elevated because users may visit untrusted content more frequently.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects a network-accessible vulnerability with low attack complexity and low privilege requirements, but crucially requires user interaction (the user must visit the attacker's page while authenticated). The vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N indicates high impact to integrity and confidentiality of the uploaded files and associated data, but no availability impact. The rating is neither critical (which would require no user interaction or widely-available exploits) nor moderate, landing squarely in the HIGH category.

Frequently asked questions