CVE-2026-55746CWE-79cross-site-scripting

CVE-2026-55746

High · published June 18, 2026

CVSS v3.1
7.6
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00296 · 21.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-06-18T12:16Z
References (2)
https://github.com/Cotonti/Cotonti · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/Cotonti/Cotonti/blob/f43f1fc38ba4e02027786dad9dac1435c7c52b30/modules/pfs/inc/pfs.main.php#L396 · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 18 JUN 06:46Z
    Cotonti stored XSS via PFS folder title
    cvelistv5