CVE-2026-55745: Cotonti 1.0.0 Personal File Storage CSRF Vulnerability

Technical summary

The vulnerability resides in modules/pfs/inc/pfs.editfolder.php, specifically in the folder update action ('a=update'). The code modifies folder metadata (title, description, and visibility flags) without invoking the cot_check_xg() function, which is responsible for validating anti-CSRF tokens in the Cotonti framework. This omission allows an attacker to craft a malicious HTML page or script that, when visited by an authenticated Cotonti user, causes their browser to submit a forged request that modifies folder properties. The attacker does not need authentication; exploitation requires only that the victim be logged into Cotonti and visit the attacker-controlled page.

Business impact

This vulnerability could allow an attacker to alter the privacy settings of sensitive file collections stored by Cotonti users. A private folder containing internal documents, personal files, or confidential information could be made public, resulting in unauthorized disclosure. Additionally, an attacker could modify folder metadata to create confusion or defacement. Organizations using Cotonti for internal file sharing should assess whether unintended folder exposure could lead to compliance violations (such as HIPAA, GDPR, or industry-specific regulations) or loss of competitive advantage.

Affected systems

Cotonti version 1.0.0 (master branch, commit f43f1fc3) is confirmed affected. The Personal File Storage module is required for the vulnerability to be exploitable; systems with PFS disabled or removed are not at risk. Verify whether your deployment matches the affected commit hash and whether PFS is enabled in your installation.

Exploitability

Exploitation requires user interaction: an authenticated Cotonti user must visit an attacker-controlled website while logged in. The attack is straightforward to execute—a simple form submission or image tag can trigger the forged request—and requires no special privileges or system access. The CVSS 3.1 score of 5.4 (MEDIUM) reflects the requirement for user interaction and the limited scope of impact (confidentiality and integrity of folder metadata only, with no availability impact). The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog.

Remediation

Apply the cot_check_xg() anti-CSRF token validation to the folder update action in pfs.editfolder.php before processing any metadata changes. Verify against the vendor's official advisory for the recommended patch version or commit hash. As an interim control, restrict access to the PFS module to trusted internal networks or disable PFS if it is not in active use.

Patch guidance

Check the Cotonti project repository and official security advisories for a patched version addressing this vulnerability. Ensure that any patch includes the addition of proper CSRF token validation in the folder update code path. Test the patch in a non-production environment before deployment to confirm that PFS functionality remains intact and that legitimate folder updates continue to work as expected.

Detection guidance

Monitor HTTP request logs for POST requests to modules/pfs/inc/pfs.editfolder.php with the 'a=update' parameter originating from external or suspicious referrer headers (or with missing Referer headers altogether). Look for patterns of folder metadata changes occurring without corresponding user interface interactions from expected administrative accounts. Security monitoring tools can be configured to alert on requests to this endpoint that lack valid CSRF token parameters or have mismatched origin headers.

Why prioritize this

Although the CVSS score is MEDIUM (5.4) and user interaction is required, the impact of unauthorized folder exposure could be significant in regulated or security-sensitive environments. Organizations hosting sensitive documents or operating under compliance frameworks should prioritize remediation. The simplicity of the attack vector and the potential for undetected privacy violations warrant timely patching.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a network-based attack with low complexity that requires no elevated privileges but does require user interaction (visiting a malicious page). The impact is limited to low-level confidentiality and integrity (folder metadata and visibility), with no availability impact. This places the vulnerability in the MEDIUM severity band. Organizations should weigh this score against their specific risk tolerance and the sensitivity of data stored in their Cotonti PFS instances.

Frequently asked questions