Cotonti CMS's Comments plugin deserializes user‑supplied data without restricting the classes that may be instantiated. A POST parameter obtained via trim‑only sanitization is passed to unserialize() with no restriction. Any member with write access to comments can supply this parameter, making the vulnerability reachable via the public Create action. This PHP Object Injection allows an attacker to construct a serialized payload that will instantiate arbitrary PHP objects. Depending on the available gadget chains in the system, the attacker could achieve destructive database writes or potentially remote code execution.

The vulnerability is triggered in any instance of Cotonti CMS that includes the Comments plugin and grants members write permissions to comments. The CNA release notes do not list specific version numbers, so based on the absence of a version range in the CNA data, we infer that all versions that have not applied a remediation removing the unsafe unserialize are potentially affected.

The CVSS base score of 7.7 indicates high severity. The attack vector is web‑based, using a POST request to the CreateAction endpoint. Because any member with default RW rights can reach the vulnerable parameter, the privilege requirement is very low. EPSS is < 1 % and the vulnerability is not yet cataloged in CISA’s KEV program, suggesting that exploitation has not yet been widely observed. Nonetheless, the ability to inject arbitrary PHP objects that can trigger destructive database writes and, if gadget chains exist, potentially remote code execution, presents a considerable risk to exposed installations.