CVE-2026-91939

CRITICAL 9.8

Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.

CWE	CWE-502
Vendor	cotonti
Product	cotonti
Published	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for cotonti cotonti

Be the first to know when new critical vulnerabilities affecting cotonti cotonti are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Cotonti / Cotonti

1.0.0 ≤ 1.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Cotonti/Cotonti/issues/1888 github.com: https://github.com/Cotonti/Cotonti/pull/1889 github.com: https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/inc/CommentsWidget.php github.com: https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/controllers/actions/DisplayAction.php github.com: https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/comments.setup.php github.com: https://github.com/Cotonti/Cotonti vulncheck.com: https://www.vulncheck.com/advisories/cotonti-1.0.0-comments-plugin-php-object-injection-via-ci-parameter

Credits

🔍 Harsh Raj Singhania