CVE-2026-55746: Stored XSS in Cotonti 1.0.0 Personal File Storage Module

Technical summary

The vulnerability exists in Cotonti 1.0.0's Personal File Storage (PFS) module due to inadequate input validation and output encoding. When importing folder metadata, the pff_title field is processed through a 'TXT' filter that does not strip or encode HTML content (the tag-checking mechanism in cot_import is disabled). The folder title is then passed to the template engine without htmlspecialchars() sanitization in modules/pfs/inc/pfs.main.php and output unescaped in modules/pfs/tpl/pfs.tpl as {PFF_ROW_TITLE}. This allows arbitrary HTML and JavaScript to execute with the privileges of the viewing user.

Business impact

Attackers with valid user credentials can compromise the accounts of other users, including administrators, by executing malicious scripts when they browse folder listings. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of legitimate users, defacement of folder content, or lateral movement within the organization. The impact escalates significantly if administrators view the poisoned folder, potentially granting attackers elevated system access.

Affected systems

Cotonti version 1.0.0 (master branch, commit f43f1fc3) is confirmed vulnerable. Organizations running this version with the Personal File Storage module enabled are at risk, particularly those where multiple users share folder listings or where public folder sharing is enabled.

Exploitability

Exploitation requires valid authentication to the Cotonti instance—an attacker must have an existing user account or obtain one. No user interaction is required beyond normal browsing; when a victim visits the folder listing page containing the injected title, the payload executes automatically. The attack surface is broad because any authenticated user can create or modify folder titles, and the impact spreads to all users who view those folders.

Remediation

Upgrade to a patched version of Cotonti when available. As an interim mitigation, restrict folder creation and editing permissions to trusted administrators only, disable public folder sharing, and limit which users can view folder listings. Additionally, implement a Web Application Firewall (WAF) rule to detect and block script tags in folder title parameters.

Patch guidance

Consult the Cotonti project repository and official security advisories for patched release versions. Verify that any update includes fixes for input validation in the PFS module's import function and output encoding in the template layer. Test patches thoroughly in a staging environment before deploying to production.

Detection guidance

Monitor HTTP requests for encoded or obfuscated script tags (e.g., <script>, javascript:, onerror=) in folder creation or import API calls. Review access logs for users accessing folder listings shortly after new folders are created by other users. Search application logs for warnings related to invalid HTML in folder metadata. Consider implementing Content Security Policy (CSP) headers to restrict inline script execution and mitigate XSS payload impact.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (7.6), stored nature (persistent across sessions and users), and ease of exploitation by any authenticated user. The broad victim scope—including administrators and other users—combined with the potential for privilege escalation and account compromise makes this a critical remediation priority, particularly in multi-user or public-facing Cotonti deployments.

Risk score, explained

The CVSS 3.1 score of 7.6 (HIGH severity) reflects: network-accessible attack vector; low attack complexity (no special conditions required); low privilege requirement (authenticated users only, not admin); required user interaction (victim must view the folder); changed scope (XSS can affect users beyond the attacker's immediate scope); high confidentiality impact (session hijacking, credential theft); and low integrity and no availability impact. The score appropriately captures the serious but not system-wide destructive nature of the attack.

Frequently asked questions