CVE-2026-58143: Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint
Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes the application's CSRF validation function. Attackers can disable the PFS module's file extension whitelist by setting pfsfilecheck to 0, enabling any user with PFS access to upload and execute arbitrary PHP files on the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cotonti Sienato a version that resolves this vulnerability.Fixed in 0.9.26 - Configuration
Set pfsfilecheck to 1 (do not set to 0) to prevent disabling the PFS file extension whitelist so users with PFS access cannot upload/execute arbitrary PHP files.
PFS module pfsfilecheck = 1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58143?
The severity of CVE-2026-58143 is rated as high with a score of 8.8.
How do I fix CVE-2026-58143?
To fix CVE-2026-58143, upgrade to the latest version of Cotonti Siena that has patched the CSRF vulnerability.
What are the potential impacts of CVE-2026-58143?
CVE-2026-58143 allows unauthenticated attackers to modify administrator configurations, potentially leading to full site compromise.
Which software versions are affected by CVE-2026-58143?
CVE-2026-58143 affects Cotonti Siena version 0.9.26 and earlier.
What type of vulnerability is CVE-2026-58143?
CVE-2026-58143 is a cross-site request forgery (CSRF) vulnerability.