CVE-2026-58143: Cotonti Siena CSRF Allows Remote Code Execution via File Upload Bypass

Technical summary

The vulnerability is a classic CSRF flaw (CWE-352) affecting Cotonti Siena's administrative configuration interface. The admin.php endpoint processes POST requests to update configuration parameters without invoking the application's CSRF validation function. An attacker crafts a forged POST request that sets the pfsfilecheck parameter to 0, disabling file extension validation in the PFS module. Since no CSRF token is required, the request succeeds if a logged-in administrator visits the attacker's page. Once file extension checking is disabled, the same or different users with PFS access can upload PHP files instead of only permitted file types, gaining remote code execution. The attack requires user interaction (UI:R) but no authentication (PR:N) from the attacker's perspective.

Business impact

Successful exploitation leads to remote code execution on the web server, enabling attackers to steal sensitive data, modify business-critical information, deploy malware, or establish persistent backdoors. The attack vector is particularly dangerous because it requires only that an administrator remain logged into Siena while visiting an attacker-controlled site—a realistic scenario in multi-tab browsing environments. Organizations running Cotonti Siena as a CMS or portal platform face potential complete server compromise and downstream damage to users and partners who trust the platform.

Affected systems

Cotonti Siena version 0.9.26 and all earlier versions are vulnerable. Users should verify their exact version in the admin panel or filesystem. No vendor product list was provided in the source data, so check the official Cotonti website or your deployment documentation to confirm version status. Siena is used primarily in small-to-medium business and community portals.

Exploitability

The vulnerability is straightforward to exploit from a technical standpoint: an attacker simply hosts an HTML form that auto-submits a POST request to the target Siena installation's admin.php with the malicious configuration parameter. No special tools, authentication, or server-side access are required. The main barrier is social engineering—getting an authenticated administrator to visit the attacker's page. This is a moderate social engineering lift compared to phishing or malware delivery, making the overall exploitability high. The attack is also repeatable and does not depend on race conditions or timing.

Remediation

Upgrade to a patched version of Cotonti Siena that implements CSRF token validation (verify against the vendor advisory for the specific version number). If an immediate patch is unavailable, implement network-level mitigations: restrict admin.php access to trusted IP ranges, enforce HTTPS with SameSite cookie attributes set to 'Strict', and educate administrators to avoid opening untrusted links while logged into Siena. Consider using a Web Application Firewall (WAF) rule to require a valid CSRF token header on POST requests to admin.php, though this is a temporary control pending patching.

Patch guidance

Contact the Cotonti development team or check the official Cotonti website for a security patch release. Apply the patch to all instances of Cotonti Siena in production and development environments. Test the patch in a staging environment first to confirm admin functionality and PFS module behavior remain intact. After patching, verify that the pfsfilecheck parameter is restored to its default secure state (file extension validation enabled) and that CSRF tokens are enforced on admin.php requests.

Detection guidance

Monitor web server logs for POST requests to admin.php that lack a valid CSRF token header or cookie, especially those originating from external or suspicious sources. Check admin configuration logs (if available) for unexpected changes to the pfsfilecheck parameter or other security settings. Search the filesystem for recently uploaded PHP files in the PFS upload directory, particularly those with suspicious names or timestamps coinciding with suspected attack windows. Deploy a WAF rule to log all POST requests to admin.php and alert on those missing CSRF validation headers.

Why prioritize this

This vulnerability scores 8.8 (HIGH) due to the combination of network accessibility, low attack complexity, and high impact (confidentiality, integrity, availability). The attack bypasses authentication entirely by exploiting trust in an administrator's session, and successful exploitation grants remote code execution—the highest severity outcome. While it requires user interaction, the interaction is a common browser behavior (visiting a link), not a sophisticated social engineering trick. Organizations should treat this as urgent, especially if Siena is internet-facing or handles sensitive business data.

Risk score, explained

CVSS 3.1 score of 8.8 reflects: AV:N (network-based attack, no physical proximity), AC:L (low complexity, straightforward CSRF), PR:N (no prior authentication from attacker), UI:R (requires administrator to visit attacker's page), S:U (impact isolated to affected system), C:H (confidential data can be read via RCE), I:H (system and configuration integrity fully compromised), A:H (availability can be affected via RCE or denial-of-service). The HIGH severity is justified by the remote code execution risk and the ease of weaponization.

Frequently asked questions