CVE-2026-71294

Summary

The Cotonti CMS Comments plugin allows untrusted data deserialization without class restrictions, enabling attackers with comment write access to execute arbitrary code on the server. This vulnerability arises from insufficient sanitization of user-supplied data during comment creation.

Exploitability

Exploitation requires a member with write access to comments (which is default), making it moderately easy to achieve with minimal prerequisites.

Blast radius

If exploited, this vulnerability could allow remote code execution on the server, potentially leading to full system compromise and data exfiltration across all affected Cotonti CMS installations using the Comments plugin.

Detection

Monitor for unusual POST requests to /plugins/comments/controllers/actions/CreateAction.php with serialized data in request parameters, particularly from authenticated users with comment write privileges.

Prioritized remediation

Upgrade to Cotonti CMS version 2.590 or later to address this deserialization vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.