CVE-2026-93872— Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter
Quick assessment
Affected
Cotonti Cotonti
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cotonti 1.0.0 在评论插件的 EditAction 中，将 Base64 解码后的 参数直接传入 函数，且未对可反序列化的类进行 白名单限制。拥有评论写权限的注册用户能够实例化任意的 PHP 对象，并有可能通过“gadget 链”（小工具链）实现文件写入或代码执行。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93872
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chains.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-93872
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93872
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-93872 (1)
Vendor Pages for CVE-2026-93872 (1)
Other References for CVE-2026-93872 (3)
Same Patch Batch · Cotonti · 2026-09-18 · 6 CVEs total
| CVE-2026-93868 | 8.1 HIGH | Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG |
| CVE-2026-93869 | 6.1 MEDIUM | Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex |
| CVE-2026-93871 | 5.4 MEDIUM | Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix |
| CVE-2026-93870 | 4.3 MEDIUM | Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler |
| CVE-2026-93873 | 4.3 MEDIUM | Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin |
IV. Related Vulnerabilities
Same product: Cotonti
-
CVE-2026-93873
Cotonti through 1.0.0 Cross-Site Request Forgery in the Cont -
CVE-2026-93871
Cotonti through 1.0.0 Stored Open Redirect via Page redir: P -
CVE-2026-93870
Cotonti through 1.0.0 Cross-Site Request Forgery in the Rati -
CVE-2026-93869
Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_c -
CVE-2026-93868
Cotonti through 1.0.0 Predictable Password Recovery Token vi
Same vendor: Cotonti
-
CVE-2026-93873
Cotonti through 1.0.0 Cross-Site Request Forgery in the Cont -
CVE-2026-93871
Cotonti through 1.0.0 Stored Open Redirect via Page redir: P -
CVE-2026-93870
Cotonti through 1.0.0 Cross-Site Request Forgery in the Rati -
CVE-2026-93869
Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_c -
CVE-2026-93868
Cotonti through 1.0.0 Predictable Password Recovery Token vi
Same weakness: CWE-502
-
CVE-2026-81657
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-11711
IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5 -
CVE-2025-66455
LMDeploy has Remote Code Execution by Pickle Deserialization -
CVE-2026-10751
IBM MQ Java messaging is vulnerable to remote code execution -
CVE-2026-17086
ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+
V. Comments for CVE-2026-93872
No comments yet