Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the redir: prefix in page bodies. An attacker can redirect users to arbitrary external sites by creating or editing pages, potentially facilitating phishing attacks. Remediation There is no fixed version for...

CVE-2026-93871

Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious...

CVE-2026-93871

Cotonti (a CMS) through 1.0.0 contains a stored open redirect vulnerability in its page module. The root cause is a failure to validate redirect destinations in page bodies prefixed with redir: . Any authenticated user with page creation or edit permissions can store a redirect to an arbitrary ex...

CVE-2026-93871 Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix

Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious...

CVE-2026-93871 Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix

Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious...

CVE-2026-93871 Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix

Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious...

CVE-2026-93871: URL Redirection to Untrusted Site

Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious...