CVE-2026-55745

Name of the Vulnerable Software and Affected Versions Cotonti version 1.0.0

Description The Personal File Storage (PFS) module is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks an authenticated user into performing unwanted actions. In the file 'modules/pfs/inc/pfs.editfolder.php', the folder update action 'a=update' modifies folder metadata, such as title, description, and public/gallery flags, without executing the cot check xg() function to validate the anti-CSRF token. This allows a remote attacker to force a victim's browser to submit a forged request, potentially changing private folders to public.

Recommendations For version 1.0.0, implement a call to the cot check xg() function within the 'a=update' action in 'modules/pfs/inc/pfs.editfolder.php' to validate the anti-CSRF token before updating folder metadata.