Unsafe Deserialization in Cotonti CMS (CVE-2026-71294)
Summary
Vulnerability in Cotonti CMS (CVE-2026-71294). Confidential information can be exposed externally. Exploitable via allowed_classes.
Original description
The description as published by the source.
Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a ci POST parameter obtained via cot_import('ci', 'P', 'TXT') (trim-only sanitization) is passed to unserialize(base64_decode($ci)) with no allowed_classes restriction, reachable by any member with write access to comments (the default Auth_members => 'RW' setting in plugins/comments/comments.setup.php). In plugins/comments/controllers/actions/EditAction.php, a cb parameter is similarly deserialized via unserialize(base64_decode($this->comeback)) in prepareComeBack(), reachable by any member editing their own comment. Because unserialize() is called without allowed_classes, an attacker can construct a serialized PHP object of any class loaded by Cotonti (a PHP Object Injection primitive). This was demonstrated in practice using Cotonti's own MySQL_cache class: a crafted serialized MySQL_cache object, once deserialized and later garbage-collected, triggers its __destruct()->flush() chain, causing an attacker-controlled INSERT INTO cot_cache with attacker-chosen row values — confirming genuine POP-chain exploitation, with further impact (including potential RCE) contingent on other gadget chains available in a given Cotonti installation's loaded classes. A third sink in DeleteAction.php contains the identical unserialize() pattern but is gated behind an admin-only authorization check and i…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-71294 has been found in Cotonti CMS.
Attackers can target a specific entry point like allowed_classes over the network to misuse the product.
Confidential information can be exposed externally. CVSS score: 7.6/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "Cotonti CMS CVE-2026-71294" on the vendor's site.
CVE-2026-71294 (Cotonti CMS) — CWE-502 / CVSS v3 7.6
Attack vector: remote (network-reachable) / no user interaction
Attack surface: allowed_classes
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Unsafe deserialization (CWE-502) exists in Cotonti CMS. Attackers reach the vulnerable code path via allowed_classes.
Check the vendor advisory for the affected versions of Cotonti CMS. Attack surface: allowed_classes.
Severity: High (CVSS 7.6/10). Confidential information can be exposed externally.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
Audit SBOM/dependencies for affected components.資産台帳・SBOM・依存マニフェストで Cotonti CMS を使っているサービスとバージョンを洗い出す。
-
2Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
References
- web github.com
- web github.com
- web nvd.nist.gov
- web github.com