CVE-2026-55746

Name of the Vulnerable Software and Affected Versions Cotonti version 1.0.0

Description The Personal File Storage (PFS) module allows authenticated users to store HTML or JavaScript within a folder title. This occurs because the pff title variable is imported using a 'TXT' filter that fails to strip or encode HTML. In the file modules/pfs/inc/pfs.main.php, the title is assigned to the PFF ROW TITLE template variable without using htmlspecialchars(), and the file modules/pfs/tpl/pfs.tpl outputs {PFF ROW TITLE} unescaped. Consequently, the injected script executes in the browser of any user viewing the folder listing, including users accessing public folders. This is a stored Cross-Site Scripting (XSS) issue, where malicious scripts are permanently stored on the server and served to other users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.