Cotonti 1.0.0 in the master branch contains a Cross‑Site Request Forgery flaw in its Personal File Storage module. The vulnerable file, modules/pfs/inc/pfs.editfolder.php, performs folder metadata updates without validating the anti‑CSRF token via cot_check_xg. As a result, an attacker can submit a forged request that modifies a folder’s title, description, or visibility flags, potentially exposing private data or altering user content.

The affected product is Cotonti Cotonti, specifically its Personal File Storage module at commit f43f1fc3 in the master branch. Users running this version or a cosmetically similar unpatched release are susceptible to unauthorized folder metadata changes.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of < 1% suggests a low likelihood of exploitation currently. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user who visits a malicious or phishing page that triggers the update action, requiring only a normal web session; no privileged access or network exposure is necessary. The attack vector is inferred to be social‑engineering or crafted link delivery to an active session.