7.6highHigh

CVE-2026-71294

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restriction, reachable by any member with write access to comments (the default setting in plugins/comments/comments.setup.php).

What the metrics mean

It is reachable over a network, without needing local access.
For an attacker who can reach it, no special conditions are needed to exploit it.
To exploit it, an ordinary user account is needed.
Beyond that, no action by a user is required.

Scoring

CVSS: 7.6 (v3.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Weakness: CWE-502
Assigned by: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Dates

Published: 2026-08-05
Last modified: 2026-08-26
Sources: NVD

References

https://github.com/Cotonti/Cotonti
https://github.com/Cotonti/Cotonti/blob/master/plugins/comments/controllers/actions/CreateAction.php