CVE-2026-93872CWE-502insecure-deserialization

CVE-2026-93872

High · published September 19, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
53.0
In the wild
Unconfirmed
What it is

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chains.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
7.7 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00710 · 53.0th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-09-19T00:17Z
References (6)
https://github.com/Cotonti/Cotonti · [email protected]https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/controllers/actions/EditAction.php · [email protected]https://github.com/Cotonti/Cotonti/blob/1.0.0/system/cache.php · [email protected]https://github.com/Cotonti/Cotonti/issues/1894 · [email protected]https://github.com/Cotonti/Cotonti/pull/1897 · [email protected]https://www.vulncheck.com/advisories/cotonti-1.0.0-php-object-injection-via-comments-plugin-edit-action-cb-parameter · [email protected]
EPSS history
Timeline
  • 20 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 18 SEP 19:56Z
    Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter
    cvelistv5