Cotonti Siena 0.9.26 and all earlier releases suffer a cross‑site request forgery flaw (CWE‑352) that allows an unauthenticated attacker to trick a logged‑in administrator into submitting a forged POST to the admin.php configuration update endpoint. The endpoint never invokes CSRF validation, so the attacker can change configuration settings, notably setting pfsfilecheck to 0. This disables the Permission File System (PFS) module’s file‑extension whitelist, allowing any user with PFS upload rights to upload and execute arbitrary PHP files on the web server, effectively giving the attacker remote code execution capabilities.

The vulnerability affects the Cotonti Siena content management system in version 0.9.26 and all earlier releases. No other vendors or product lines have been identified as impacted.

The flaw carries a high severity CVSS score of 8.7, but its EPSS score is < 1%, indicating a very low probability of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires an active administrator session and the attacker to lure that administrator into submitting the malicious request, typically via social engineering or phishing. Once the configuration change is applied, any user with PFS upload privileges can drop malicious PHP files, leading to complete compromise of the affected web server.