CRITICAL 9.3 NVD
CVE-2026-91939
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiat
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.
References
- https://github.com/Cotonti/Cotonti
- https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/comments.setup.php
- https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/controllers/actions/Display
- https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/comments/inc/CommentsWidget.php
- https://github.com/Cotonti/Cotonti/issues/1888
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-09-15 via NVD.
Risk Timeline
CVE Disclosed2026-09-15 · -1 days ago
Remediation Resources
vulnfeed aggregates 14340 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.