CVE-2026-55744

Name of the Vulnerable Software and Affected Versions Cotonti version 1.0.0

Description The Personal File Storage (PFS) module is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a logged-in user into performing unwanted actions. In the file modules/pfs/inc/pfs.main.php, the upload action 'a=upload' fails to call the cot check xg() function to validate the anti-CSRF token. This allows a remote attacker to lure an authenticated user to a malicious page and force their browser to submit a forged multipart request, resulting in the upload of arbitrary files into the user's PFS storage.

Recommendations For version 1.0.0, ensure the cot check xg() function is called within the 'a=upload' action in modules/pfs/inc/pfs.main.php to validate the anti-CSRF token. As a temporary mitigation, restrict access to the Personal File Storage (PFS) module.