GHSA-86hp-hf3j-3m8r
Cotonti: Stored Cross-Site Scripting in the Personal File Storage (PFS) module
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | cotonti/cotonti | <= 1.0.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title. In modules/pfs/inc/pfs.main.php the title is assigned to the template variable PFF_ROW_TITLE without htmlspecialchars(), and modules/pfs/tpl/pfs.tpl outputs {PFF_ROW_TITLE} unescaped. When the folder listing is viewed (including by other users for public folders), the injected script executes in the victim's browser.
References
External links from the advisory. They lead to third-party sites.