CVE-2026-91939 Details
Description
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.
A PHP object injection vulnerability has been identified in the Cotonti Comments plugin version 1.0.0. The issue arises because the plugin's 'DisplayAction' controller passes the 'ci' GET parameter to the 'unserialize()' function without any restrictions on allowed classes. This flaw allows unauthenticated attackers to instantiate arbitrary PHP classes with controlled properties. Exploitation of this vulnerability could lead to unauthorized database manipulation or, in some cases, remote code execution.
The vulnerability can be addressed by modifying the 'CommentsWidget::run()' method to use 'unserialize()' with the 'allowed_classes' option set to false or with a specific allowlist of classes. After unserializing, the code should validate the structure of the resulting data before use. A proposed fix is available in pull request #1889.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cotonti/Cotonti/issues/1888 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/Cotonti/Cotonti | [email protected] | Vendor |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/comments.setup.php | [email protected] | Source CodeVendor |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/controllers/actions/DisplayAction.php | [email protected] | Source CodeVendor |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/inc/CommentsWidget.php | [email protected] | Source CodeVendor |
| https://github.com/Cotonti/Cotonti/issues/1888 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/Cotonti/Cotonti/pull/1889 | [email protected] | Issue TrackingVendor |
| https://www.vulncheck.com/advisories/cotonti-1.0.0-comments-plugin-php-object-injection-via-ci-parameter | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cotonti | 1.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |