{"id":"CVE-2026-71294","published":"2026-08-05T13:24:54.180","lastModified":"2026-08-10T12:17:32.113","description":"Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restriction, reachable by any member with write access to comments (the default setting in plugins/comments/comments.setup.php).","cvssScore":7.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Cotonti/Cotonti","tags":[]},{"url":"https://github.com/Cotonti/Cotonti/blob/master/plugins/comments/controllers/actions/CreateAction.php","tags":[]}],"exploitRefs":[{"url":"https://github.com/Cotonti/Cotonti","tags":[]},{"url":"https://github.com/Cotonti/Cotonti/blob/master/plugins/comments/controllers/actions/CreateAction.php","tags":[]}],"hasPoc":true,"ai":{"summary":"The Cotonti CMS Comments plugin allows untrusted data deserialization without class restrictions, enabling attackers with comment write access to execute arbitrary code on the server. This vulnerability arises from insufficient sanitization of user-supplied data during comment creation.","exploitability":"Exploitation requires a member with write access to comments (which is default), making it moderately easy to achieve with minimal prerequisites.","blast_radius":"If exploited, this vulnerability could allow remote code execution on the server, potentially leading to full system compromise and data exfiltration across all affected Cotonti CMS installations using the Comments plugin.","remediation":"Upgrade to Cotonti CMS version 2.590 or later to address this deserialization vulnerability.","detection":"Monitor for unusual POST requests to /plugins/comments/controllers/actions/CreateAction.php with serialized data in request parameters, particularly from authenticated users with comment write privileges.","tags":["rce","deserialization","cms","web"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:56:32.631Z"}}