Unauthenticated PHP Object Injection in Cotonti Comments Plugin

The Cotonti 1.0.0 Comments plugin contains a critical security vulnerability (CVE-2026-91939) involving improper input validation. The plugin accepts a 'ci' GET parameter from unauthenticated users and passes this value directly to the PHP 'unserialize()' function without applying an 'allowed_classes' restriction. This allows remote attackers to perform PHP object injection, enabling the instantiation of arbitrary classes within the application context. By providing a crafted serialized payload, an attacker can manipulate object properties to trigger gadget chains. Depending on the available classes within the environment, this vulnerability can be leveraged to achieve arbitrary code execution or unauthorized database manipulation, posing a significant risk to the integrity and confidentiality of the host system.

Impact

Successful exploitation of CVE-2026-91939 allows for unauthenticated remote code execution. This can lead to full system compromise, unauthorized access to the underlying database, and potential data exfiltration or service disruption. All instances of Cotonti running version 1.0.0 with the affected Comments plugin enabled are at risk of complete compromise.

Recommendation

Prioritize the identification of all internet-facing Cotonti instances within the environment. Until a vendor patch is applied, restrict access to the web application at the network perimeter or implement WAF rules to inspect and block 'ci' GET parameters containing serialized PHP objects, identifiable by strings such as 'O:7:' or 's:x:'. Verify the current version of the Comments plugin and evaluate the necessity of disabling the plugin if an immediate upgrade to a patched version is not possible.