CVE-2026-93871CWE-601

CVE-2026-93871

Medium · published September 19, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
18.7
In the wild
Unconfirmed
What it is

Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious sites for phishing attacks without administrative privileges.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00274 · 18.7th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-09-19T00:17Z
References (5)
https://github.com/Cotonti/Cotonti · [email protected]https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/page/inc/page.main.php · [email protected]https://github.com/Cotonti/Cotonti/issues/1893 · [email protected]https://github.com/Cotonti/Cotonti/pull/1901 · [email protected]https://www.vulncheck.com/advisories/cotonti-through-1.0.0-stored-open-redirect-via-page-redir-prefix · [email protected]
EPSS history
Timeline
  • 20 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 18 SEP 19:56Z
    Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix
    cvelistv5