The vulnerability allows an authenticated user to embed arbitrary HTML or JavaScript into a Personal File Storage folder title. Because Cotonti imports the title with the 'TXT' filter and later renders it unescaped, the script runs when the folder listing is viewed. An attacker can steal session cookies, deface the site, or redirect users through malicious URLs from any user who views the exposed folder.

Affected systems are Cotonti CMS version 1.0.0 (master branch), identified by commit f43f1fc3. Any instance that uses the Personal File Storage module and has public or shared folders is vulnerable. The flaw resides in modules/pfs/inc/pfs.main.php at line 396 and the associated template output.

The CVSS score of 7 indicates a high severity, while the EPSS score of less than 1% suggests a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires an authenticated web user; once an attacker stores malicious content, the script affects any other user who views the folder, thereby extending the impact beyond the originator.