CVE-2026-91939: Cotonti Comments Plugin RCE Vulnerability

CVE-2026-91939 is a remote code execution vulnerability in Cotonti 1.0.0 Comments plugin caused by unsafe deserialization. Attackers can exploit this flaw to execute arbitrary code without authentication. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-91939 Overview

Cotonti 1.0.0 contains a PHP object injection vulnerability in the Comments plugin. The plugin passes the ci GET parameter directly to PHP's unserialize() function without an allowed_classes restriction. Unauthenticated attackers can send crafted serialized payloads to instantiate arbitrary PHP classes with attacker-controlled properties. Successful exploitation can trigger gadget chains leading to database manipulation or remote code execution. The flaw is categorized as [CWE-502] Deserialization of Untrusted Data.

Critical Impact
Unauthenticated remote attackers can achieve code execution or database manipulation through PHP object injection via the ci parameter.

Affected Products

Cotonti CMS version 1.0.0
Cotonti Comments plugin (plugins/comments/)
Deployments exposing the DisplayAction controller to the internet

Discovery Timeline

2026-09-15 - CVE-2026-91939 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91939

Vulnerability Analysis

The Cotonti Comments plugin accepts a ci GET parameter and passes its value into PHP's native unserialize() function. The call omits the allowed_classes option, so the deserializer will instantiate any class defined in the running application. This behavior enables PHP object injection, where an attacker supplies a serialized object graph that triggers magic methods such as __wakeup(), __destruct(), or __toString() during deserialization. Because Cotonti loads numerous internal classes and third-party libraries, attackers can chain those methods into gadget chains that reach filesystem, database, or command-execution sinks. No authentication is required to reach the vulnerable code path.

Root Cause

The root cause is unsafe deserialization of untrusted input. PHP's unserialize() reconstructs objects and invokes magic methods based on serialized data. Without the allowed_classes => false option (or a strict allow-list), any autoloaded class becomes a candidate gadget. The Comments plugin trusts a user-controlled GET parameter as if it were internally generated state.

Attack Vector

An unauthenticated attacker crafts a serialized PHP object payload and sends it as the ci query string parameter to a URL served by the Comments plugin DisplayAction controller. The application deserializes the payload, instantiates the attacker-selected class with attacker-controlled properties, and triggers magic methods when the object is used or destroyed. Depending on available gadgets in Cotonti core and loaded plugins, the chain can write files, modify database rows, or execute arbitrary PHP.

See the VulnCheck Advisory on Cotonti and the GitHub DisplayAction Controller for the vulnerable code path.

Detection Methods for CVE-2026-91939

Indicators of Compromise

HTTP GET requests to Comments plugin endpoints containing a ci parameter whose value begins with serialized PHP tokens such as O:, a:, or s:.
URL-encoded serialized payloads (for example %4F%3A) in query strings targeting the Comments plugin.
Unexpected PHP worker child processes spawning shells, curl, wget, or writing to web-accessible directories.
New or modified PHP files in plugins/ or web root directories after suspicious ci requests.

Detection Strategies

Inspect web server access logs for ci= parameters carrying serialized object markers and alert on any match.
Deploy a Web Application Firewall (WAF) rule that blocks serialized PHP object patterns in query strings for Cotonti URLs.
Monitor PHP-FPM or Apache error logs for __wakeup, __destruct, or class-not-found messages tied to Comments plugin requests.

Monitoring Recommendations

Forward web server, PHP, and database audit logs to a centralized analytics pipeline for correlation across request, process, and file-write events.
Track outbound network connections from the web server user to detect reverse shells or data exfiltration following exploitation attempts.
Alert on integrity changes to Cotonti plugin directories and configuration files.

How to Mitigate CVE-2026-91939

Immediate Actions Required

Restrict or disable public access to the Comments plugin until a patched version is deployed.
Apply upstream fixes referenced in GitHub Pull Request #1889 that address the unsafe unserialize() call.
Block requests containing serialized PHP object markers in the ci parameter at the WAF or reverse proxy layer.
Review web server, database, and PHP logs for exploitation attempts dating back to before the patch was applied.

Patch Information

Upstream discussion and remediation are tracked in GitHub Issue #1888 and GitHub Pull Request #1889. Administrators should upgrade to a Cotonti release that incorporates the fix or manually patch plugins/comments/controllers/actions/DisplayAction.php and related files to pass ['allowed_classes' => false] to unserialize() or replace the call with a safe format such as JSON.

Workarounds

Add a WAF signature that denies any request where the ci parameter matches the regex ^[Oa]:\d+: or its URL-encoded equivalents.
Modify the vulnerable code to validate that ci is a numeric comment identifier before any deserialization occurs.
Remove or disable the Comments plugin in plugins/comments/comments.setup.php if the feature is not required.

bash

# Example WAF rule (ModSecurity) to block serialized PHP objects in the ci parameter
SecRule ARGS:ci "@rx ^(?:O|a|s|i|b|d):[0-9]+:" \
    "id:1029191939,phase:2,deny,status:403,log,\
    msg:'CVE-2026-91939 Cotonti Comments PHP object injection attempt'"