Vulnerability Description
Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious sites for phishing attacks without administrative privileges.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/Cotonti/Cotonti
- https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/page/inc/page.main.php
- https://github.com/Cotonti/Cotonti/issues/1893
- https://github.com/Cotonti/Cotonti/pull/1901
- https://www.vulncheck.com/advisories/cotonti-through-1.0.0-stored-open-redirect-
FAQ
What is CVE-2026-93871?
CVE-2026-93871 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary e...
How severe is CVE-2026-93871?
CVE-2026-93871 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-93871?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.