GHSA-86hp-hf3j-3m8r
Cotonti: Stored Cross-Site Scripting in the Personal File Storage (PFS) module
Details
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title. In modules/pfs/inc/pfs.main.php the title is assigned to the template variable PFF_ROW_TITLE without htmlspecialchars(), and modules/pfs/tpl/pfs.tpl outputs {PFF_ROW_TITLE} unescaped. When the folder listing is viewed (including by other users for public folders), the injected script executes in the victim's browser.
Are you affected?
Enter the version of the package you're using.
Affected packages
0 No fixed version published yet for cotonti/cotonti (composer). Pin to a known-safe version or switch to an alternative.