CVE-2026-71294
Received Received - Intake

PHP Object Injection in Cotonti CMS Comments Plugin

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a `ci` POST parameter obtained via `cot_import('ci', 'P', 'TXT')` (trim-only sanitization) is passed to `unserialize(base64_decode($ci))` with no `allowed_classes` restriction, reachable by any member with write access to comments (the default `Auth_members => 'RW'` setting in plugins/comments/comments.setup.php). In plugins/comments/controllers/actions/EditAction.php, a `cb` parameter is similarly deserialized via `unserialize(base64_decode($this->comeback))` in prepareComeBack(), reachable by any member editing their own comment. Because unserialize() is called without allowed_classes, an attacker can construct a serialized PHP object of any class loaded by Cotonti (a PHP Object Injection primitive). This was demonstrated in practice using Cotonti's own MySQL_cache class: a crafted serialized MySQL_cache object, once deserialized and later garbage-collected, triggers its __destruct()->flush() chain, causing an attacker-controlled INSERT INTO cot_cache with attacker-chosen row values — confirming genuine POP-chain exploitation, with further impact (including potential RCE) contingent on other gadget chains available in a given Cotonti installation's loaded classes. A third sink in DeleteAction.php contains the identical unserialize() pattern but is gated behind an admin-only authorization check and is not reachable by ordinary members.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71294
EUVD
EUVD-2026-53379

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cotonti cms *
cotonti cotonti *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Cotonti CMS's Comments plugin improperly deserializes user input without restricting which classes can be instantiated. Attackers with write access to comments can exploit this by sending crafted serialized PHP objects, leading to potential object injection attacks.

Detection Guidance

Detecting this vulnerability requires checking for signs of PHP object injection attempts in Cotonti CMS logs or network traffic. Look for unusual base64-encoded POST parameters named 'ci' or 'cb' in comments-related requests. Inspect server logs for unserialize() calls without allowed_classes restrictions. No specific commands are provided in the context.

Impact Analysis

An attacker could execute arbitrary code, manipulate database entries, or perform unauthorized actions like deleting or modifying cached data. This could lead to data breaches, system compromise, or further exploitation depending on available gadget chains.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Non-compliance risks include legal penalties and reputational damage.

Mitigation Strategies

Immediately update Cotonti CMS to the latest version that patches this issue. Disable write access to comments for non-trusted users by setting Auth_members to 'R' in plugins/comments/comments.setup.php. Disable the Comments plugin if not essential. Monitor for suspicious INSERT INTO cot_cache queries in database logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71294. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart