CVE-2026-55745 PUBLISHED

Cotonti CSRF in PFS folder edit allows unauthorized folder modification

Assigner: TuranSec
Reserved: 17.06.2026 Published: 18.06.2026 Updated: 18.06.2026

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action ('a=update') updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg() to validate the anti-CSRF token. A remote attacker who lures an authenticated user into visiting a malicious page can force the browser to submit a forged request that modifies the victim's folder metadata, including making a private folder public.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 5.3

Product Status

Vendor Cotonti
Product Cotonti
Versions Default: affected
  • Version 1.0.0 is affected

Credits

  • Saidakbarxon Maxsudxonov (sermikro), Innova Networks finder

References

Problem Types

  • CWE-352 Cross-Site Request Forgery (CSRF) CWE