CVE-2026-93872: Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter
Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowedclasses restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chains.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be a registered user who has permission to write comments. Unauthenticated visitors are not described as able to exploit it.
What access and conditions are required for exploitation?
The attacker needs network access, a low-privileged account with comment write permissions, and the ability to supply a crafted base64-encoded cb parameter to the comments plugin EditAction. Successful impact depends on usable PHP object gadget chains being present.
Are confidentiality, integrity, and availability at risk?
Yes. The reported severity vector rates confidentiality, integrity, and availability as high, and the issue may enable file writes or code execution when suitable gadget chains exist.
How can I determine whether an installation is affected?
Check whether the deployment runs Cotonti 1.0.0 and has the comments plugin EditAction available. The affected code path base64-decodes the cb parameter and passes it to unserialize() without an allowed_classes restriction.