CVE-2026-91939: Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the Comments plugin code so that the ci GET parameter is not passed to unserialize() without an allowed_classes restriction (e.g., call unserialize($data, ['allowed_classes' => [...]]) or otherwise prevent object deserialization).
Cotonti Comments Plugin (PHP) unserialize() handling of ci GET parameter = unserialize() with allowed_classes restriction
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it by sending a crafted serialized payload in the ci GET parameter to the affected Comments plugin.
What conditions are needed for exploitation?
The affected Cotonti 1.0.0 Comments plugin must be reachable to the attacker. Successful impact such as database manipulation or code execution depends on usable PHP gadget chains in the application environment.
How can I determine whether an installation is affected?
Check whether the installation uses Cotonti 1.0.0 with the Comments plugin and whether plugins/comments/inc/CommentsWidget.php passes the ci GET parameter to unserialize() without an allowed_classes restriction.