CVE-2026-91939

Cotonti 1.0.0's Comments plugin feeds the unauthenticated 'ci' GET parameter directly into PHP's unserialize() without the allowed_classes restriction, allowing arbitrary PHP objects with attacker-controlled properties to be instantiated. By sending a crafted serialized payload in the URL, an unauthenticated attacker can trigger gadget chains available in the application, resulting in database manipulation or remote code execution. The flaw is rated critical (CVSS 4.0: 9.3) and is classified as CWE-502 (deserialization of untrusted data). Sites running Cotonti 1.0.0 with the Comments plugin enabled are affected. No public proof of concept is known, the issue is not in CISA's KEV catalog, and there is no evidence of exploitation in the wild, but exploitation requires only a simple HTTP request once a viable gadget chain is identified.

What to do: Upgrade Cotonti to the latest release as soon as a fixed version is available, or disable the Comments plugin if it is not needed. In the meantime, use a WAF or reverse proxy rule to block requests to the Comments plugin containing suspicious serialized data in the 'ci' parameter (e.g., strings starting with 'O:' or 'a:'). Audit web server logs for historical requests with a 'ci' parameter carrying serialized payload markers, and verify database integrity and web roots for signs of code injection.