Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.6

Cotonti pages can send visitors to any external site

CVE-2026-93871 · published 1 month ago
Summary

In Cotonti versions up to 1.0.0, users who can create or edit pages can insert a special link that sends visitors to any website they choose. This lets an attacker place a page on a trusted domain that automatically redirects users to a malicious site, facilitating phishing. Update Cotonti to the latest version or apply the provided patch to validate redirect URLs.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
cotonti cotonti <= 1.0.0
Original advisory text
Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix
Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious sites for phishing attacks without administrative privileges.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-601Open Redirect
Timeline
Published18 Sep 2026
Updated3 Nov 2026
First seen18 Sep 2026
Sources
CVE-2026-93871 · NVD
CVE-2026-93871 · MITRE
CVE-2026-93871 · OSV
Track software like this
Free during beta