CVE-2026-71294: Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions
Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restriction, reachable by any member with write access to comments (the default setting in plugins/comments/comments.setup.php).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71294?
CVE-2026-71294 has a severity rating of high, with a score of 7.7.
How do I fix CVE-2026-71294?
To fix CVE-2026-71294, restrict the classes allowed in the unserialize() function within the Comments plugin.
What kind of attack can be executed due to CVE-2026-71294?
CVE-2026-71294 can lead to PHP object injection attacks due to unrestricted deserialization of user input.
Which software is affected by CVE-2026-71294?
CVE-2026-71294 affects the Cotonti Comments Plugin for Cotonti CMS.
What is the potential impact of CVE-2026-71294?
The potential impact of CVE-2026-71294 includes code execution and data manipulation due to the vulnerability in deserialization.