CVE-2026-93871

Name of the Vulnerable Software and Affected Versions Cotonti versions prior to 1.0.1

Description Authenticated users with page creation or edit permissions can store redirects to arbitrary external hosts because the software fails to validate redirect destinations in page bodies prefixed with redir:. This allows attackers to create pages on trusted domains that redirect visitors to malicious sites for phishing purposes without requiring administrative privileges.

Recommendations Update Cotonti to a version newer than 1.0.0.