CVE-2026-55745: Cotonti CSRF in PFS folder edit allows unauthorized folder modification
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action ('a=update') updates folder metadata (title, description, public/gallery flags) without calling cotcheckxg() to validate the anti-CSRF token. A remote attacker who lures an authenticated user into visiting a malicious page can force the browser to submit a forged request that modifies the victim's folder metadata, including making a private folder public.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add a call to cot_check_xg() to validate the anti-CSRF token before handling the folder update action ('a=update') so that folder metadata (title, description, public/gallery flags) cannot be modified via CSRF.
Cotonti modules/pfs/inc/pfs.editfolder.php cot_check_xg() = call before processing 'a=update'
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55745?
CVE-2026-55745 has a medium severity rating of 5.4.
What type of vulnerability is CVE-2026-55745?
CVE-2026-55745 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.
How can CVE-2026-55745 be exploited?
CVE-2026-55745 can be exploited through unauthorized folder modification in the Personal File Storage module.
Which version of Cotonti is affected by CVE-2026-55745?
CVE-2026-55745 affects Cotonti version 1.0.0, specifically the master branch.
How do I fix CVE-2026-55745?
To mitigate CVE-2026-55745, ensure proper CSRF token verification is implemented in the folder update actions.