CVE-2026-58143

Name of the Vulnerable Software and Affected Versions Cotonti Siena versions prior to 0.9.27

Description A cross-site request forgery (CSRF) issue exists where unauthenticated attackers can modify administrator configurations. This occurs because the admin.php config update handler does not invoke the application's CSRF validation function. By tricking a logged-in administrator into submitting a forged POST request, an attacker can set the pfsfilecheck variable to 0. This action disables the Perfect Forward Secrecy (PFS) module's file extension whitelist, allowing any user with PFS access to upload and execute arbitrary PHP files on the server.

Recommendations Update Cotonti Siena to a version newer than 0.9.26. Restrict access to the admin.php config update handler to minimize the risk of exploitation.