HIGH

CVE-2026-71294

2026-08-05 CVSS v3.1

CVSS

7.6

Description

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restriction, reachable by any member with write access to comments (the default setting in plugins/comments/comments.setup.php).

Weakness (CWE)

CWE-502 Deserialization of Untrusted Data

EPSS Score

0.22%

Probability of exploitation in next 30 days

13.3th percentile

References

https://github.com/Cotonti/Cotonti https://github.com/Cotonti/Cotonti/blob/master/plugins/comments/controllers/actions/CreateAction.php

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE