Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck

CVE-2026-91939Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter

Critical 9.8

In plain English

A critical-severity unsafe deserialization in Cotonti from Cotonti. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.0%top 37.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.

Affected products (as reported)

Vendor	Product	Versions
Cotonti	Cotonti	1.0.0 – through 1.0.0

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Issue #1888 issue-tracking
Proposed fix PR #1889 (unmerged) patch, issue-tracking
CommentsWidget::run() at 1.0.0 technical-description
AJAX display controller at 1.0.0 technical-description
Default comments permissions at 1.0.0 technical-description
https://github.com/Cotonti/Cotonti product
VulnCheck Advisory: Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter third-party-advisory