CVE-2026-58144 Details
Description
Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users with PFS access to inject arbitrary script payloads by supplying malicious HTML in the ntitle parameter processed through the TXT filter in pfs.main.php. Attackers can create a folder with a crafted title containing script tags that are stored unescaped in the database and execute in the browser of any user who views the folder listing, including administrators.
A stored cross-site scripting vulnerability has been identified in Cotonti Siena versions through 0.9.26. This issue allows authenticated users with Personal File Space (PFS) access to inject arbitrary scripts by entering malicious HTML into the folder title, which is processed through a text filter. The injected scripts are stored in the database without proper escaping and executed in the browsers of users who view the folder listing, including administrators.
To address this vulnerability, sanitize the folder title before storing it in the database by using 'htmlspecialchars()' to escape special characters. Additionally, ensure that the PFS module properly escapes titles when rendering them in the PFS listing.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 9, 2026CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/sermikr0/75686815e441c07462cfdea2fed5d305 | [email protected] | BundleExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cotonti | <= 0.9.x |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |