CVE-2026-71294: Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a ci POST parameter obtained via cotimport('ci', 'P', 'TXT') (trim-only sanitization) is passed to unserialize(base64decode($ci)) with no allowedclasses restriction, reachable by any member with write access to comments (the default Authmembers => 'RW' setting in plugins/comments/comments.setup.php). In plugins/comments/controllers/actions/EditAction.php, a cb parameter is similarly deserialized via unserialize(base64decode($this->comeback)) in prepareComeBack(), reachable by any member editing their own comment. Because unserialize() is called without allowedclasses, an attacker can construct a serialized PHP object of any class loaded by Cotonti (a PHP Object Injection primitive). This was demonstrated in practice using Cotonti's own MySQLcache class: a crafted serialized MySQLcache object, once deserialized and later garbage-collected, triggers its destruct()->flush() chain, causing an attacker-controlled INSERT INTO cotcache with attacker-chosen row values — confirming genuine POP-chain exploitation, with further impact (including potential RCE) contingent on other gadget chains available in a given Cotonti installation's loaded classes. A third sink in DeleteAction.php contains the identical unserialize() pattern but is gated behind an admin-only authorization check and is not reachable by ordinary members.