PHP Object Injection Vulnerability in Cotonti Comments Plugin
CVE-2026-71294

7.7HIGH

Key Information:

Vendor

Cotonti

Status
Cotonti
Vendor
CVE Published:
5 August 2026

What is CVE-2026-71294?

The Comments plugin of Cotonti CMS contains a serious flaw due to improper deserialization of user-supplied data. Specifically, the ci and cb parameters in the CreateAction.php and EditAction.php scripts are processed without restricting the classes that can be instantiated. This vulnerability allows authenticated users with write access to comments to inject serialized PHP objects, leading to potential exploitation via crafted objects. The exploitation demonstrated includes triggering sophisticated object manipulation resulting in unauthorized database operations, with risks of remote code execution based on the classes present in the affected system. This highlights the necessity for stringent input validation and implementation of allowed classes during data deserialization.

Affected Version(s)

Cotonti 0

References

https://github.com/Cotonti/Cotonti
https://github.com/Cotonti/Cotonti/blob/master/plugins/co...

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Saidakbarxon Maxsudxonov
.