CVE-2026-55744: Cotonti CSRF in PFS allows forced arbitrary file upload
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action ('a=upload') processes uploaded files without calling cotcheckxg() to validate the anti-CSRF token, even though sibling actions such as 'delete' (line 272) do. A remote attacker who lures an authenticated user into visiting a malicious page can force the browser to submit a forged multipart request that uploads arbitrary files into the victim's PFS storage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
modules/pfsfrom your environment.If the Personal File Storage (PFS) module is not required, uninstall or disable the modules/pfs component to prevent CSRF-triggered arbitrary file uploads.
- Configuration
Ensure the upload action ('a=upload') calls cot_check_xg() to validate the anti-CSRF token before processing uploaded files (add a cot_check_xg() call at the start of the 'a=upload' handling, similar to the existing call in the 'delete' action).
modules/pfs/inc/pfs.main.php cot_check_xg() for 'a=upload' = present - Compensating control
As a temporary mitigation until the code is fixed, disable PFS file uploads or restrict access to the PFS upload endpoint (a=upload) to trusted IPs/internal networks or place the endpoint behind a web application firewall to block forged multipart upload requests.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55744?
CVE-2026-55744 has a severity rating of 8.1, categorized as high.
How do I fix CVE-2026-55744?
To fix CVE-2026-55744, ensure that the file upload action in the Personal File Storage module validates the anti-CSRF token using cot_check_xg().
What type of vulnerability is CVE-2026-55744?
CVE-2026-55744 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Personal File Storage module.
What impact does CVE-2026-55744 have on my system?
Exploiting CVE-2026-55744 allows an attacker to force arbitrary file uploads, potentially leading to further attacks or data breaches.
In which version of Cotonti is CVE-2026-55744 found?
CVE-2026-55744 is found in Cotonti version 1.0.0, specifically in the master branch, commit f43f1fc3.