CVE-2026-100522 Overview
Cotonti through version 1.0.0 contains a reflected cross-site scripting (XSS) vulnerability in message.php. The lng parameter is not properly escaped before being rendered in the confirmation dialog. Unauthenticated attackers can craft malicious links containing script payloads in the lng parameter to execute arbitrary JavaScript in a victim's browser session. Successful exploitation requires user interaction, typically through a phishing link. The flaw is tracked as CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Attackers can execute arbitrary JavaScript in victim browsers to steal session cookies, perform actions on behalf of authenticated users, or redirect users to attacker-controlled content.
Affected Products
- Cotonti Content Management System through version 1.0.0
- The message.php component handling the lng URL parameter
- Deployments exposing Cotonti to untrusted web clients
Discovery Timeline
- 2026-09-26 - CVE-2026-100522 published to NVD
- 2026-09-28 - Last updated in NVD database
Technical Details for CVE-2026-100522
Vulnerability Analysis
The vulnerability resides in message.php, a Cotonti script that renders confirmation and notification dialogs. The lng request parameter, intended to control the language of the displayed message, is reflected directly into the HTML response without contextual output encoding. Because the sink is an HTML context, an attacker-controlled string containing <script> tags or event handlers is parsed and executed by the browser. The attack requires no authentication, which broadens the exploitable population to any visitor who follows a crafted link.
Root Cause
The root cause is missing output escaping on user-controlled input before it is written to the HTML response. Cotonti accepts the lng parameter from the query string and passes it into the confirmation template without applying htmlspecialchars() or an equivalent escaping routine. This matches the pattern described in CWE-79.
Attack Vector
Exploitation is network-based and requires user interaction. An attacker crafts a URL pointing at a vulnerable Cotonti instance with a malicious payload in the lng parameter, then delivers the link through email, chat, or a third-party site. When the victim clicks the link, the injected JavaScript executes in the origin of the Cotonti application, where it can access cookies not marked HttpOnly, read Document Object Model (DOM) contents, and issue same-origin requests. See the VulnCheck Cotonti Advisory and the vendor tracking in GitHub Issue #1907 and Pull Request #1908 for technical details.
No verified public exploit code is available. The vulnerability mechanism is a direct reflection of the lng query parameter into HTML without encoding; see the referenced advisories for the sink location in message.php.
Detection Methods for CVE-2026-100522
Indicators of Compromise
- Web server access logs showing requests to message.php with suspicious lng values containing <, >, script, onerror, or URL-encoded equivalents such as %3Cscript%3E.
- Referrer headers pointing to external domains preceding anomalous message.php requests.
- Spikes in outbound requests from client browsers immediately after visiting a Cotonti message.php URL.
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule that inspects the lng parameter on message.php requests for HTML and JavaScript metacharacters.
- Hunt historical web logs for query strings matching regex patterns such as lng=.*(%3C|<)script or lng=.*on[a-z]+=.
- Correlate browser Content Security Policy (CSP) violation reports with Cotonti request paths to identify attempted injections.
Monitoring Recommendations
- Enable verbose HTTP access logging on all Cotonti hosts and forward logs to a central analytics platform.
- Alert on repeated 2xx responses to message.php where the lng parameter length exceeds a baseline threshold.
- Monitor phishing feeds and threat intelligence sources for URLs referencing vulnerable Cotonti endpoints.
How to Mitigate CVE-2026-100522
Immediate Actions Required
- Review the status of GitHub Pull Request #1908 and apply the fix once merged into a tagged release.
- Restrict access to message.php through authentication or IP allowlisting where feasible until a patched build is deployed.
- Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of reflected XSS.
- Set the HttpOnly and Secure flags on all session cookies to prevent theft through injected JavaScript.
Patch Information
As of the NVD publication date, the fix is tracked in GitHub Issue #1907 and proposed in Pull Request #1908 against the Cotonti repository. Administrators should upgrade to a release that incorporates proper escaping of the lng parameter in message.php. Consult the VulnCheck advisory for current fix guidance.
Workarounds
- Add a WAF or reverse-proxy filter that strips or rejects lng parameter values containing <, >, ", ', or & characters before they reach message.php.
- Apply a local patch to message.php that wraps the lng output in htmlspecialchars($lng, ENT_QUOTES, 'UTF-8') prior to rendering.
- Deploy a Content Security Policy header such as Content-Security-Policy: default-src 'self'; script-src 'self' to block execution of inline injected scripts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
