CVE-2026-58144: Stored XSS in Cotonti Siena File Management (CVSS 5.4)

Technical summary

The vulnerability exists in pfs.main.php where the ntitle parameter is processed through a TXT filter without proper HTML escaping before storage. An authenticated user with PFS (personal file system) access can supply malicious HTML containing script tags in the folder name. These payloads bypass sanitization, are stored unescaped in the database, and execute client-side when any user retrieves and displays the folder listing. The XSS context is cross-origin (reflected in the CVSS:3.1 S:C component), meaning the injected script can access sensitive data or perform actions beyond the immediate application scope.

Business impact

A compromised user account or insider with file management access can silently inject malicious scripts that target all users viewing affected folders. Potential impacts include stealing session tokens or credentials from administrators, performing unauthorized actions on behalf of users, redirecting users to phishing sites, or harvesting sensitive information from the page context. Because scripts can execute in administrator browsers, the blast radius extends well beyond the initial attacker's privilege level, creating a lateral escalation vector within the application.

Affected systems

Cotonti Siena version 0.9.26 and all earlier releases are affected. Organizations running this CMS should inventory all Siena deployments and verify their version numbers against this threshold.

Exploitability

Exploitation requires valid authentication and prior assignment of PFS access permissions—typically file management or content creation privileges. The attack surface is limited to authenticated users, reducing opportunistic external exploitation. However, the CVSS score reflects that user interaction (an administrator or other user viewing the malicious folder) is required to trigger the payload. No special network positioning or low-level system access is needed; the attack works over the network through standard HTTP requests. The barrier to exploitation is moderate: an attacker needs a valid account with appropriate permissions, which may be obtainable through credential compromise, insider threat, or overly permissive role assignments.

Remediation

Upgrade to a patched version of Cotonti Siena released after 0.9.26—verify the exact version against the vendor's security advisory. The fix should include proper HTML entity encoding or output escaping of the ntitle parameter before storage and display. Until patching is possible, restrict PFS access to trusted users only and regularly audit folder names for suspicious content.

Patch guidance

Apply the security update from the Cotonti project for Siena. Verify the specific patched version number against the official Cotonti security advisory or vendor website. Test the update in a non-production environment before full deployment to ensure compatibility with custom extensions or configurations. After patching, clear any cached folder listings to prevent stale XSS payloads from executing.

Detection guidance

Monitor file management logs for folder creation or modification events, particularly those containing HTML tags, script tags, or encoded payloads in the ntitle field. Search the database for folder names containing strings like '<script', 'javascript:', 'onerror=', or other XSS vectors. Review web server logs for unusual activity following folder creation operations. Implement content security policy (CSP) headers to mitigate the impact of injected scripts even if they are stored. Use a Web Application Firewall (WAF) to detect and block requests containing script tags in folder name parameters.

Why prioritize this

Although this vulnerability requires authentication and user interaction, it represents a meaningful privilege escalation risk: a low-privileged user with file access can craft attacks targeting administrators. The stored nature means payloads persist indefinitely until discovered and removed. CVSS 5.4 (MEDIUM) appropriately reflects the requirement for both authentication and user interaction, but the cross-origin scope and potential to compromise high-privilege accounts warrant prioritization in environments where file management is delegated to many users or where insider risk is a concern.

Risk score, explained

The CVSS:3.1 score of 5.4 MEDIUM is derived from network-accessible attack vector (AV:N), low attack complexity (AC:L), and requirement for low-privilege authenticated access (PR:L). User interaction is required (UI:R), preventing fully automated exploitation. Scope is changed (S:C), meaning the vulnerability can affect resources beyond the security scope of the vulnerable component—here, administrators or other users viewing the folder. Confidentiality and integrity are both impacted (C:L/I:L) through script execution, while availability is not affected (A:N). The score reflects moderate risk appropriate for an authenticated XSS with admin-targeting potential.

Frequently asked questions