CVE-2026-55746: Cotonti stored XSS via PFS folder title
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pfftitle) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cotimport is disabled), so an authenticated user can store HTML/JavaScript in a folder title. In modules/pfs/inc/pfs.main.php the title is assigned to the template variable PFFROWTITLE without htmlspecialchars(), and modules/pfs/tpl/pfs.tpl outputs {PFFROWTITLE} unescaped. When the folder listing is viewed (including by other users for public folders), the injected script executes in the victim's browser.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable the tag check in cot_import so the 'TXT' filter strips or encodes HTML when importing folder titles.
cot_import tag check = enabled - Configuration
Wrap folder title values with htmlspecialchars() before assigning them to the template variable PFF_ROW_TITLE (e.g., PFF_ROW_TITLE = htmlspecialchars($title, ENT_QUOTES, 'UTF-8')).
modules/pfs/inc/pfs.main.php assign PFF_ROW_TITLE via htmlspecialchars() = true - Configuration
Change the template to output the PFF_ROW_TITLE value in escaped/HTML-encoded form rather than raw {PFF_ROW_TITLE}, so injected HTML/JavaScript is not rendered.
modules/pfs/tpl/pfs.tpl PFF_ROW_TITLE output escaping = escaped - Operational
Sanitize existing Personal File Storage (PFS) folder titles to remove any embedded HTML or JavaScript (for example, run a one-time script to replace stored titles with HTML-encoded equivalents or strip tags) until code changes are deployed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55746?
The severity of CVE-2026-55746 is rated as high, with a score of 7.6.
How do I fix CVE-2026-55746?
To fix CVE-2026-55746, ensure that user-generated input in the Personal File Storage module is properly sanitized and encoded.
What type of vulnerability is CVE-2026-55746?
CVE-2026-55746 is a stored Cross-Site Scripting (XSS) vulnerability affecting Cotonti.
Who is affected by CVE-2026-55746?
Authenticated users of Cotonti 1.0.0 are affected by CVE-2026-55746 due to the lack of input sanitization.
What are the potential impacts of CVE-2026-55746?
The potential impacts of CVE-2026-55746 include the execution of malicious scripts in the context of an authenticated user's browser.