Cotton Cloud (com_cotton) below 2.0.2 - Unauthenticated Access to the Entire File Store

Cotton Cloud is a database backed cloud file store for Joomla, shipped as the pkg_cotton package (com_cotton file manager, com_shuttle terminal and MCP server, com_weaver editor, mod_cotton, plg_editors-xtd_cotton, LibCotton). In every release up to and including 2.0.1 the login check sits in the view layer, so it only runs when the component renders a page. The task endpoints never construct the view, and their only gate is a CSRF token check, which Joomla happily issues to an anonymous visitor. A visitor with no account and no session can therefore read, overwrite, delete and re-assign permissions on every file held in the store, regardless of who owns it, and can create new files inside another user's folder. Because the component serves stored files with a Content-Type derived from the file extension, an uploaded .html file is returned as text/html and executes on the site's own origin, which makes stored cross site scripting a downstream consequence. This is not remote code execution: files live in a database column, never on a web served path, so a stored .php file is echoed as bytes rather than executed. CVE-2026-67283, CVSS 4.0 6.9 Medium (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N), CWE-284 improper access control, published 12 August 2026 by the Joomla CNA and reported by Phil Taylor of mySites.guru. Update to Cotton Cloud 2.0.2 or later. Interim mitigation: unpublish any Cotton menu items and unpublish the Cotton and Shuttle components, since unpublishing the menu item alone does not close the task endpoints.

Affected versions: < 2.0.2

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

How CVE-2026-67283 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

Affected extensions and versions