PHP Object Injection Vulnerability in Cotonti Comments Plugin
CVE-2026-71294

7.7HIGH

Key Information:

Vendor

Cotonti

Status
Cotonti
Vendor
CVE Published:
5 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-71294?

The Comments plugin of Cotonti CMS contains a serious flaw due to improper deserialization of user-supplied data. Specifically, the ci and cb parameters in the CreateAction.php and EditAction.php scripts are processed without restricting the classes that can be instantiated. This vulnerability allows authenticated users with write access to comments to inject serialized PHP objects, leading to potential exploitation via crafted objects. The exploitation demonstrated includes triggering sophisticated object manipulation resulting in unauthorized database operations, with risks of remote code execution based on the classes present in the affected system. This highlights the necessity for stringent input validation and implementation of allowed classes during data deserialization.

Affected Version(s)

Cotonti 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cotonti-commentswidget-poc
Created by HarshRajSinghania

References

https://github.com/Cotonti/Cotonti
third-party-advisory
https://github.com/Cotonti/Cotonti/blob/master/plugins/co...
third-party-advisory

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Saidakbarxon Maxsudxonov
.