Cotonti Security Hardening Summary: Fixes for CSRF, XSS, Open Redirect, Weak Cryptography, Object Injection (CVE-2026-53741)

Cotonti Security Hardening Patch Summary Vulnerability Overview Security hardening fixes for the Cotonti project (Issue #1907), revised following CNA technical review. The primary fixes address the following vulnerability types: 1. CSRF (CWE-352) - Cross-Site Request Forgery 2. XSS (CWE-79) - Cross-Site Scripting 3. Open redirect (CWE-601) - Open Redirect 4. Weak tokens / crypto (CWE-330/338) - Weak Tokens/Cryptography 5. Object injection (CWE-502) - Object Injection 6. Upload / hardening - Uploads/Security Hardening Impact Scope CSRF Vulnerabilities Admin: (CVE-2026-53741 / CVE-2026-58123), (CVE-2026-53742), , , , (install/update/pause/unpause/pausegroup/unpausegroup), (add) Modules / plugins: page add & edit, PM send & star, forums new topic & new post, contact submit & moderation tools (delete/mass/send), referrers prune/prune/unwithdraw, autoalias2 create, PPS file edit, PPS upload & new folder, i18n structure update XSS Vulnerabilities — highlight output to JS RegExp via (unauthenticated reflected XSS) — log fallback body escaped (unauthenticated reflected XSS) — category / sub-category titles escaped — trash-info value escaped Open Redirect — allowlist regex end-anchored with , rejecting and Weak Tokens and → Password recovery and email-change validation keys → Object Injection on comments (callback sinks) and the session load Upload Hardening PPS script-extension denylist widened and made case-insensitive Minimum password length raised to 8 Remediation 1. CSRF Remediation Token check added to the mutating handler, with the token appended to its form/link URL URL validation using Token verification for action URLs 2. XSS Remediation Escaping at output points Safe encoding using Escaping of category/sub-category titles 3. Open Redirect Remediation Modified function with end-anchored regex Verified redirects in , , and confirm-dialog Verified target in 4. Weak Token Remediation Replaced with Used for password recovery and email change validation keys 5. Object Injection Remediation Restricted deserialization classes using 6. Upload Hardening Extended PPS script extension denylist and made it case-insensitive Increased minimum password length to 8 Added traversal protection for the parameter Technical Correction Notes Original CSRF assumptions in the initial report were re-validated per CNA review: The global POST anti-CSRF gate in means POST handlers are already covered by C14, C18, C24, and C33. These independently CSRFable merge points lack local calls. C14 CSRF — While RCE could theoretically occur in host mode as originally described, its write path is POST-gated. The original CVE statements have been withdrawn; existing changes should be considered defense-in-depth rather than fixes for independently exploitable POST-CSRF vulnerabilities. The remaining C13 narrative is accurate: the original POST edit vector has been withdrawn, but has an independent GET group-deletion path lacking . Code Examples Commit Information Batch 2 (commit 9ec2841): Extended CSRF coverage to remaining handlers Fix GET CSRF in admin user group deletion (commit 3316a898307e48f1e8f115334a3b308a84ab7)

Goal Reached Thanks to every supporter — we hit 100%!

Cotonti Security Hardening Summary: Fixes for CSRF, XSS, Open Redirect, Weak Cryptography, Object Injection (CVE-2026-53741)

More from this source