In Cotonti 1.0.0 the Personal File Storage module accepts file uploads without validating the anti‑CSRF token, creating a flaw where a forged request can deposit any file into the victim’s storage. The lack of request validation permits an attacker to upload malicious content that may later be accessed, viewed or executed by the authenticated user, threatening confidentiality and integrity.

All installations of Cotonti 1.0.0 (master branch at commit f43f1fc3) that use the Personal File Storage module are impacted. The vulnerability exists in the file upload action and can affect any site running the affected version of Cotonti.

With a CVSS score of 8.6 the flaw is considered high severity. The EPSS score of less than 1% indicates a low current exploitation probability, and it is not listed in the CISA KEV catalog. The attack vector requires a remote attacker to lure an authenticated user to a malicious page that submits a forged multipart request; thus it depends on web browsers and user sessions. If exploited, the attacker can strategically place files that may be subsequently used to compromise the victim’s environment.