CVE-2026-55746: Cotonti stored XSS via PFS folder title

Published Jun 18, 2026

Updated

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pfftitle) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cotimport is disabled), so an authenticated user can store HTML/JavaScript in a folder title.

Affected Software

1 affected component

Cotonti Cotonti=1.0.0

Event History

Jun 18, 2026

CVE Published

via MITRE·06:46 AM

Data Sourced

via MITRE·06:46 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-55746?

The severity of CVE-2026-55746 is rated as high, with a score of 7.6.

How do I fix CVE-2026-55746?

To fix CVE-2026-55746, ensure that user-generated input in the Personal File Storage module is properly sanitized and encoded.

What type of vulnerability is CVE-2026-55746?

CVE-2026-55746 is a stored Cross-Site Scripting (XSS) vulnerability affecting Cotonti.

Who is affected by CVE-2026-55746?

Authenticated users of Cotonti 1.0.0 are affected by CVE-2026-55746 due to the lack of input sanitization.

What are the potential impacts of CVE-2026-55746?

The potential impacts of CVE-2026-55746 include the execution of malicious scripts in the context of an authenticated user's browser.