CVE-2026-55745

Cotonti CSRF in PFS folder edit allows unauthorized folder modification

Published Jun 18, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action ('a=update') updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg to validate the anti-CSRF token.

Analysis

Technical impact

Cotonti 1.0.0 in the master branch contains a Cross‑Site Request Forgery flaw in its Personal File Storage module. The vulnerable file, modules/pfs/inc/pfs.editfolder.php, performs folder metadata updates without validating the anti‑CSRF token via cot_check_xg. As a result, an attacker can submit a forged request that modifies a folder’s title, description, or visibility flags, potentially exposing private data or altering user content.

Affected Systems

The affected product is Cotonti Cotonti, specifically its Personal File Storage module at commit f43f1fc3 in the master branch. Users running this version or a cosmetically similar unpatched release are susceptible to unauthorized folder metadata changes.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of < 1% suggests a low likelihood of exploitation currently. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user who visits a malicious or phishing page that triggers the update action, requiring only a normal web session; no privileged access or network exposure is necessary. The attack vector is inferred to be social‑engineering or crafted link delivery to an active session.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cotonti

affected

Version	Status	Constraints
`1.0.0`	affected	—

No data.

Vendor Product Versions

Cotonti

Version	Status	Scheme	Platform
`1.0.0`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Cotonti to a version that includes CSRF validation for the PFS module.
If an upgrade is not immediately possible, disable the PFS update functionality or remove the PFS module from the site to prevent unauthorized changes.
Implement site‑wide CSRF protection so that all state‑changing requests validate anti‑CSRF tokens and enforce strict access controls on file storage features.

Generated by OpenCVE AI on August 10, 2026 at 23:43 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-hp3v-wp32-953h	Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.097% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/Cotonti/Cotonti
https://github.com/Cotonti/Cotonti/blob/f43f1fc38ba4e02027786dad9dac1435c7c52b30/modules/pfs/inc/pfs.editfolder.php#L90

History

Aug 10, 2026 12:00 PM Description updated. Title updated View changes

Type	Values Removed	Values Added
Description	Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action ('a=update') updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg() to validate the anti-CSRF token. A remote attacker who lures an authenticated user into visiting a malicious page can force the browser to submit a forged request that modifies the victim's folder metadata, including making a private folder public.	Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action ('a=update') updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg to validate the anti-CSRF token.
Title	Cotonti - CSRF in PFS Folder Edit Allows Unauthorized Folder Modification	Cotonti CSRF in PFS folder edit allows unauthorized folder modification

Aug 10, 2026 11:45 AM Title updated View changes

Type	Values Removed	Values Added
Title	Cotonti CSRF in PFS folder edit allows unauthorized folder modification	Cotonti - CSRF in PFS Folder Edit Allows Unauthorized Folder Modification

Jun 24, 2026 9:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cotonti Cotonti cotonti
Vendors & Products		Cotonti Cotonti cotonti

Jun 18, 2026 4:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action ('a=update') updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg() to validate the anti-CSRF token. A remote attacker who lures an authenticated user into visiting a malicious page can force the browser to submit a forged request that modifies the victim's folder metadata, including making a private folder public.
Title		Cotonti CSRF in PFS folder edit allows unauthorized folder modification
Weaknesses		CWE-352
References		https://github.com/Cotonti/Cotonti https://github.com/Cotonti/Cotonti/blob/f43f1fc38ba4e02027786dad9dac1435c7c52b30/modules/pfs/inc/pfs.editfolder.php#L90
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`