PT-2026-68166
CVE-2026-71294
·
Published
2026-08-05
·
Updated
2026-09-13
Description by
CVSS 3.1
7.6
HighMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Name of the Vulnerable Software and Affected Versions
Cotonti CMS (affected versions not specified)
Description
The Comments plugin in Cotonti CMS fails to restrict classes during the deserialization of user-supplied data, leading to a PHP Object Injection. This occurs when the
unserialize() function is used on base64-decoded input without an allowed classes restriction. The issue is present in the following locations:- In
plugins/comments/controllers/actions/CreateAction.php, theciPOST parameter is processed. - In
plugins/comments/controllers/actions/EditAction.php, thecbparameter is processed within theprepareComeBack()function. - In
plugins/comments/controllers/actions/DeleteAction.php, a similar pattern exists but is restricted to administrators.
Members with write access to comments can exploit this to instantiate arbitrary classes loaded by the system. For example, using the
MySQL cache class, an attacker can trigger the destruct()->flush() chain to execute unauthorized INSERT INTO cot cache operations. Depending on the available gadget chains in the installation, this could potentially lead to Remote Code Execution (RCE), which is the ability to execute arbitrary commands on the server.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾