GHSA-wx35-cv59-9gwr
Suggest an improvement- Source
- https://github.com/advisories/GHSA-wx35-cv59-9gwr
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-wx35-cv59-9gwr/GHSA-wx35-cv59-9gwr.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-wx35-cv59-9gwr
- Aliases
- Published
- 2026-06-18T12:40:25Z
- Modified
- 2026-09-10T03:50:51Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
- 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module
- Details
-
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action ('a=upload') processes uploaded files without calling cot_check_xg() to validate the anti-CSRF token, even though sibling actions such as 'delete' (line 272) do. A remote attacker who lures an authenticated user into visiting a malicious page can force the browser to submit a forged multipart request that uploads arbitrary files into the victim's PFS storage.
- Database specific
{ "cwe_ids": [ "CWE-352" ], "github_reviewed": true, "github_reviewed_at": "2026-06-19T14:53:52Z", "nvd_published_at": "2026-06-18T08:16:34Z", "severity": "HIGH" }- References
Affected packages
Packagist / cotonti/cotonti
Package
- Name
- cotonti/cotonti
- Purl
- pkg:composer/cotonti/cotonti