HIGH

CVE-2026-71294

Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions

CVSS v3

7.6

HIGH

EPSS Score

exploit probability

CISA KEV

No

known exploited

Exploitation

SSVC status

Description

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a `ci` POST parameter obtained via `cot_import('ci', 'P', 'TXT')` (trim-only sanitization) is passed to `unserialize(base64_decode($ci))` with no `allowed_classes` restriction, reachable by any member with write access to comments (the default `Auth_members => 'RW'` setting in plugins/comments/comments.setup.php). In plu

Technical details

CVSS v3 Vector
3.1
Published
8/5/2026
Last Modified
8/5/2026

Frequently asked questions

What is CVE-2026-71294?

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a `ci` POST parameter obtained via `cot_import('ci', 'P', 'TXT')` (trim-only sanitization) is passed to `unserialize(base64_decode($ci))` with no `allowed_classes` restriction, reachable by any member with write access to comments (the default `Auth_members => 'RW'` setting in plugins/comments/comments.setup.php). In plu

Is CVE-2026-71294 actively exploited?

Active exploitation of CVE-2026-71294 has not been confirmed. The EPSS score is N/A%, indicating the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2026-71294?

CVE-2026-71294 has a CVSS v3 base score of 7.6 (HIGH severity), with vector string 3.1.

Is CVE-2026-71294 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.