Cotonti 1.0.0 is vulnerable to Cross‑Site Request Forgery in the Personal File Storage module; the update action for folders does not require a CSRF token. A remote attacker can lure an authenticated user to a malicious page that forces the browser to submit a forged request, altering folder metadata such as the title, description, public and gallery flags. This allows an attacker to turn a private folder into a public one or otherwise tamper with a user’s data.

The affected product is Cotonti Cotonti, specifically the PFS module in the master branch at commit f43f1fc3. Users running this version or a similar unpatched release are susceptible to unauthorized folder metadata changes.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of < 1% reflects a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user who visits a crafted page; common phishing or social engineering tactics could provide the necessary user interaction. No special system privilege or network exposure is required beyond an active user session.