PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-55744 Cotonti CVE debrief

CVE-2026-55744 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability in Cotonti 1.0.0's Personal File Storage (PFS) module. An attacker can exploit this by luring an authenticated user to visit a malicious page, forcing their browser to submit a forged multipart request that uploads arbitrary files into the victim's PFS storage. This vulnerability has a CVSS score of 8.6 and is considered HIGH severity. The issue arises from the file upload action in modules/pfs/inc/pfs.main.php not validating the anti-CSRF token.

Vendor
Cotonti
Product
Unknown
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-18
Original CVE updated
2026-06-22
Advisory published
2026-06-18
Advisory updated
2026-06-22

Who should care

Administrators and users of Cotonti 1.0.0, especially those using the Personal File Storage (PFS) module, should be aware of this vulnerability. Web application security teams and developers using Cotonti should prioritize patching this vulnerability to prevent potential attacks.

Technical summary

The vulnerability exists in the file upload action ('a=upload') of modules/pfs/inc/pfs.main.php. Unlike sibling actions such as 'delete', this action does not call cot_check_xg() to validate the anti-CSRF token. This omission allows an attacker to craft a malicious page that, when visited by an authenticated user, forces their browser to submit a forged request uploading arbitrary files to the victim's PFS storage.

Defensive priority

High

Recommended defensive actions

  • Apply the official patch or update to a fixed version of Cotonti as soon as available.
  • Implement additional CSRF protections for file upload actions in Cotonti's PFS module.
  • Restrict access to the PFS module to only trusted users and networks.
  • Monitor PFS module activity for suspicious file uploads.
  • Educate users about the risks of visiting malicious pages while authenticated to Cotonti.
  • Consider using a Web Application Firewall (WAF) to detect and block CSRF attacks.

Evidence notes

The vulnerability is confirmed in Cotonti 1.0.0 (master branch, commit f43f1fc3). The issue is located in modules/pfs/inc/pfs.main.php, specifically in the file upload action. The CVSS score of 8.6 indicates high severity. References to the vulnerable code and Cotonti repository are provided.

Official resources

public