CVE-2026-93871— Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix
Quick assessment
Affected
Cotonti Cotonti
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cotonti 1.0.0 及之前版本未能对以 "redir:" 前缀标识的页面正文中的重定向目标进行有效验证，导致拥有页面创建或编辑权限的已认证用户能够存储指向任意外部主机的重定向链接。攻击者可借此在受信任的域名上创建此类页面，使访问者被重定向至恶意网站，从而实施钓鱼攻击，且无需管理员权限。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93871
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix
Source: CVE Program / CVE List V5
Vulnerability Description
Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious sites for phishing attacks without administrative privileges.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-93871
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93871
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-93871 (1)
Vendor Pages for CVE-2026-93871 (1)
Other References for CVE-2026-93871 (3)
-
🔗 Cotonti/modules/page/inc/page.main.php at 1.0.0 · Cotonti/Cotonti · GitHub technical-description
-
-
Same Patch Batch · Cotonti · 2026-09-18 · 6 CVEs total
| CVE-2026-93868 | 8.1 HIGH | Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG |
| CVE-2026-93872 | 7.5 HIGH | Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter |
| CVE-2026-93869 | 6.1 MEDIUM | Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex |
| CVE-2026-93870 | 4.3 MEDIUM | Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler |
| CVE-2026-93873 | 4.3 MEDIUM | Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin |
IV. Related Vulnerabilities
Same product: Cotonti
-
CVE-2026-93873
Cotonti through 1.0.0 Cross-Site Request Forgery in the Cont -
CVE-2026-93872
Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit -
CVE-2026-93870
Cotonti through 1.0.0 Cross-Site Request Forgery in the Rati -
CVE-2026-93869
Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_c -
CVE-2026-93868
Cotonti through 1.0.0 Predictable Password Recovery Token vi
Same vendor: Cotonti
-
CVE-2026-93873
Cotonti through 1.0.0 Cross-Site Request Forgery in the Cont -
CVE-2026-93872
Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit -
CVE-2026-93870
Cotonti through 1.0.0 Cross-Site Request Forgery in the Rati -
CVE-2026-93869
Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_c -
CVE-2026-93868
Cotonti through 1.0.0 Predictable Password Recovery Token vi
Same weakness: CWE-601
-
CVE-2026-93869
Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_c -
CVE-2026-77386
Kyoo: OIDC login token can be redirected to an attacker-cont -
CVE-2026-77609
Semantic MediaWiki has an open redirect in Special:URIResolv -
CVE-2026-92216
a2ui-project a2ui Binder generic-binder.ts openUrl redirect -
CVE-2026-54724
Kiwi TCMS: Open Redirect via unvalidated next parameter in a
V. Comments for CVE-2026-93871
No comments yet