CVE-2026-93872 Details
Description
Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chains.
A PHP object injection vulnerability has been identified in Cotonti version 1.0.0. The issue arises in the comments plugin's EditAction, where the base64-decoded 'cb' parameter is passed to the unserialize() function without any restrictions on allowed classes. This vulnerability allows registered users with permission to write comments to instantiate arbitrary PHP objects. Exploitation of this vulnerability could lead to unauthorized file writes or remote code execution by chaining together certain object methods.
The vulnerability can be fixed by modifying the unserialize() function to include the 'allowed_classes' option set to false, which prevents the instantiation of objects during the deserialization process.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cotonti/Cotonti | [email protected] | Vendor |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/controllers/actions/EditAction.php | [email protected] | Source CodeVendor |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/system/cache.php | [email protected] | Source CodeVendor |
| https://github.com/Cotonti/Cotonti/issues/1894 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/Cotonti/Cotonti/pull/1897 | [email protected] | Issue TrackingVendor |
| https://www.vulncheck.com/advisories/cotonti-1.0.0-php-object-injection-via-comments-plugin-edit-action-cb-parameter | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cotonti | >= 1.0.0, <= 1.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |