CVE-2026-93869 Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex
Attackers can redirect users to malicious sites via unanchored regex in Cotonti CMS, potentially facilitating phishing attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-93869?
CVE-2026-93869 is a medium-severity vulnerability in Cotonti, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect destinations using a regular expression lacking an end-of-string anchor. Attackers can bypass the redirect guard by supplying hostnames beginning with the site domain to redirect users to attacker-controlled hosts through the ratings plugin or other redirect callers.
Weakness: CWE-601
Which versions are affected by CVE-2026-93869?
How do I fix CVE-2026-93869?
No fix has been published for CVE-2026-93869 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-93869 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-93869 exists.
Sources
Also known as GHSA-5p43-vwpq-wm4q.