High severity7.6NVD Advisory· Published Aug 5, 2026· Updated Aug 26, 2026

CVE-2026-71294

Description

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restriction, reachable by any member with write access to comments (the default setting in plugins/comments/comments.setup.php).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cotonti/Cotontillm-fuzzy

Patches

Vulnerability mechanics

References

github.com/Cotonti/Cotonti/blob/master/plugins/comments/controllers/actions/CreateAction.phpnvd

News mentions

No linked articles in our index yet.

cvss	0.494
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000