Stored XSS in Cotonti PFS Module

Executive Summary

CVE-2026-55746 is a stored Cross-Site Scripting (XSS) vulnerability in Cotonti 1.0.0's Personal File Storage (PFS) module. Specifically, the folder title (pff_title) is imported using a 'TXT' filter that does not remove or encode HTML content because the tag check in cot_import is disabled. This allows an authenticated user to insert HTML or JavaScript code into a folder title.

The vulnerability arises because the folder title is assigned to a template variable without applying htmlspecialchars(), and the template outputs this variable unescaped. As a result, when the folder listing is viewed by other users (including those viewing public folders), the malicious script executes in their browsers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the execution of malicious scripts in the browsers of users who view the affected folder listings. An attacker who exploits this can perform actions such as stealing session cookies, defacing the website, redirecting users to malicious sites, or performing actions on behalf of the victim user.

Since the vulnerability requires an authenticated user to inject the script, it may be limited to environments where users have some level of access, but the impact is significant because it affects other users who view the public or shared folders.

Useful 0 Not Useful 0