The vulnerability allows an authenticated user to embed arbitrary HTML or JavaScript into a Personal File Storage folder title. Since the 'TXT' filter used during import does not strip or encode HTML and the tag check in cot_import is disabled, the stored data is rendered unescaped in the folder listing. When any user views the folder, the malicious script executes, enabling session theft, site defacement, or malicious redirection.

Affected systems are Cotonti CMS version 1.0.0 (master branch), identified by commit f43f1fc3. Any instance that uses the Personal File Storage module and has public or shared folders is vulnerable. The flaw resides in modules/pfs/inc/pfs.main.php at line 396 and the associated template output.

The CVSS score of 7 indicates a high severity, while the EPSS score of less than 1% suggests a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires an authenticated web user; once an attacker stores malicious content, the script affects any other user who views the folder, thereby extending the impact beyond the originator.