CVE-2026-55746: Cotonti stored XSS via PFS folder title

Published Jun 18, 2026
·
Updated

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pfftitle) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cotimport is disabled), so an authenticated user can store HTML/JavaScript in a folder title. In modules/pfs/inc/pfs.main.php the title is assigned to the template variable PFFROWTITLE without htmlspecialchars(), and modules/pfs/tpl/pfs.tpl outputs {PFFROWTITLE} unescaped. When the folder listing is viewed (including by other users for public folders), the injected script executes in the victim's browser.

Affected Software

1 affected component
Cotonti Cotonti=1.0.0 (commit f43f1fc3, master branch)

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Enable the tag check in cot_import so the 'TXT' filter strips or encodes HTML when importing folder titles.

    cot_import tag check = enabled
  2. Configuration

    Wrap folder title values with htmlspecialchars() before assigning them to the template variable PFF_ROW_TITLE (e.g., PFF_ROW_TITLE = htmlspecialchars($title, ENT_QUOTES, 'UTF-8')).

    modules/pfs/inc/pfs.main.php assign PFF_ROW_TITLE via htmlspecialchars() = true
  3. Configuration

    Change the template to output the PFF_ROW_TITLE value in escaped/HTML-encoded form rather than raw {PFF_ROW_TITLE}, so injected HTML/JavaScript is not rendered.

    modules/pfs/tpl/pfs.tpl PFF_ROW_TITLE output escaping = escaped
  4. Operational

    Sanitize existing Personal File Storage (PFS) folder titles to remove any embedded HTML or JavaScript (for example, run a one-time script to replace stored titles with HTML-encoded equivalents or strip tags) until code changes are deployed.

Event History

Jun 18, 2026
CVE Published
via MITRE·06:46 AM
Data Sourced
via MITRE·06:46 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:16 AM
DescriptionSeverityWeakness
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-55746?

The severity of CVE-2026-55746 is rated as high, with a score of 7.6.

2

How do I fix CVE-2026-55746?

To fix CVE-2026-55746, ensure that user-generated input in the Personal File Storage module is properly sanitized and encoded.

3

What type of vulnerability is CVE-2026-55746?

CVE-2026-55746 is a stored Cross-Site Scripting (XSS) vulnerability affecting Cotonti.

4

Who is affected by CVE-2026-55746?

Authenticated users of Cotonti 1.0.0 are affected by CVE-2026-55746 due to the lack of input sanitization.

5

What are the potential impacts of CVE-2026-55746?

The potential impacts of CVE-2026-55746 include the execution of malicious scripts in the context of an authenticated user's browser.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203