CVE-2026-93871: Cotonti CMS CSRF Redirect Vulnerability

CVE-2026-93871 Overview

Cotonti through version 1.0.0 contains a stored open redirect vulnerability in its page module. The content management system fails to validate redirect destinations when page bodies are prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can weaponize trusted Cotonti-hosted URLs to send visitors to phishing sites or malware delivery pages without administrative privileges. The flaw is classified as CWE-601: URL Redirection to Untrusted Site and affects the page.main.php module handler.

Critical Impact
Authenticated attackers can craft persistent redirects on trusted Cotonti domains to facilitate phishing campaigns and reputation-based bypasses of URL filters.

Affected Products

Cotonti CMS through version 1.0.0
modules/page/inc/page.main.php component
Any Cotonti deployment permitting user-submitted or editable page content

Discovery Timeline

2026-09-18 - CVE-2026-93871 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93871

Vulnerability Analysis

Cotonti's page module supports a shortcut for administrators to convert a page into a redirect by prefixing the body with the token redir: followed by a destination URL. When a visitor requests such a page, the application issues an HTTP redirect to the value following the prefix. The handler in modules/page/inc/page.main.php does not enforce a same-origin or allowlist check on the destination, so any absolute URL is honored.

Because the redirect is stored server-side inside the page record, exploitation persists for every subsequent visitor until the page is edited or deleted. Any authenticated user granted page creation or edit permissions can plant the payload, so the flaw does not require administrative access. Attackers commonly abuse open redirects on trusted domains to bypass URL reputation filters, defeat mail gateway link inspection, and lend credibility to phishing lures.

Root Cause

The root cause is missing destination validation on the redir: control token. The page rendering code trusts operator-supplied input and constructs the redirect target without verifying that the URL points to an approved host, a relative path, or a same-site resource. See the upstream discussion in Issue #1893 and Pull Request #1901 for the code path and fix.

Attack Vector

Exploitation requires an account with permission to create or edit pages. The attacker authors a page whose body begins with the redir: prefix followed by an attacker-controlled URL, then distributes the resulting Cotonti page link through email, chat, or social media. Victims see a link on a trusted domain, click through, and are silently redirected to the attacker's site. User interaction is required, which is reflected in the CVSS 4.0 vector. See the VulnCheck advisory for additional context.

Detection Methods for CVE-2026-93871

Indicators of Compromise

Page records in the Cotonti database whose body content begins with the literal string redir: followed by an external URL.
Web server access logs showing HTTP 301 or 302 responses from /page/ endpoints pointing to unfamiliar third-party domains.
User-reported phishing complaints referencing legitimate Cotonti-hosted URLs.

Detection Strategies

Query the cot_pages table for rows where the page body matches the regular expression ^redir:https?:// and cross-reference the destination host against an allowlist.
Instrument the reverse proxy or WAF to log outbound Location headers returned by Cotonti and alert on redirects to domains outside the organization's approved list.
Audit user accounts with page creation or edit permissions and correlate recent page changes with abnormal outbound redirect activity.

Monitoring Recommendations

Ingest Cotonti web server and application logs into a centralized analytics platform and build dashboards for anomalous redirect targets.
Alert on newly created or modified pages by non-administrative accounts, especially those containing the redir: token.
Track click-through telemetry from mail security gateways to identify Cotonti URLs being used in phishing lures.

How to Mitigate CVE-2026-93871

Immediate Actions Required

Apply the fix from Cotonti Pull Request #1901 once merged into a tagged release, or backport the destination validation logic manually.
Review all existing pages for bodies starting with redir: and remove or rewrite entries pointing to untrusted hosts.
Restrict the page.add and page.edit permissions to trusted user groups until the patch is deployed.

Patch Information

The upstream fix is tracked in Pull Request #1901 against the Cotonti repository. Administrators running version 1.0.0 or earlier should monitor the repository for a tagged release incorporating the destination validation change to modules/page/inc/page.main.php.

Workarounds

Disable the redir: shortcut by modifying page.main.php to reject bodies matching the prefix, or by enforcing an allowlist of approved redirect destinations.
Place Cotonti behind a WAF rule that inspects outbound Location headers and blocks redirects to hosts outside the organization's domain.
Reduce the number of accounts holding page creation or edit privileges and require multi-factor authentication for those roles.

bash

# Example WAF rule concept (ModSecurity-style) to block off-site redirects from Cotonti page endpoints
SecRule RESPONSE_HEADERS:Location "@rx ^https?://(?!yourdomain\.com)" \
    "id:1009301,phase:3,deny,status:403,\
     msg:'CVE-2026-93871 Cotonti open redirect blocked',\
     chain"
    SecRule REQUEST_URI "@beginsWith /page/"