CVE-2026-93872

7.7 highEPSS 0.7%

High (7.7). EPSS 0.7% chance of exploitation in the next 30 days.

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chains.

Severity

CVSS 4.0

7.7 high

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2026-09-18
Modified: 2026-09-22
Record from: the NVD, synced 2026-10-19

References

https://github.com/Cotonti/Cotonti
https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/controllers/actions/EditAction.php
https://github.com/Cotonti/Cotonti/blob/1.0.0/system/cache.php
https://github.com/Cotonti/Cotonti/issues/1894
https://github.com/Cotonti/Cotonti/pull/1897

Check your stack JSON