Cotton Cloud (com_cotton) below 2.0.2 - Unauthenticated Access to the Entire File Store (CVE-2026-67283)
Cotton Cloud is a database backed cloud file store for Joomla, shipped as the pkg_cotton package (com_cotton file manager, com_shuttle terminal and MCP server, com_weaver editor, mod_cotton, plg_editors-xtd_cotton, LibCotton). In every release up to and including 2.0.1 the login check sits in the view layer, so it only runs when the component renders a page. The task endpoints never construct the view, and their only gate is a CSRF token check, which Joomla happily issues to an anonymous visitor. A visitor with no account and no session can therefore read, overwrite, delete and re-assign permissions on every file held in the store, regardless of who owns it, and can create new files inside another user's folder. Because the component serves stored files with a Content-Type derived from the file extension, an uploaded .html file is returned as text/html and executes on the site's own origin, which makes stored cross site scripting a downstream consequence. This is not remote code execution: files live in a database column, never on a web served path, so a stored .php file is echoed as bytes rather than executed. CVE-2026-67283, CVSS 4.0 6.9 Medium (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N), CWE-284 improper access control, published 12 August 2026 by the Joomla CNA and reported by Phil Taylor of mySites.guru. Update to Cotton Cloud 2.0.2 or later. Interim mitigation: unpublish any Cotton menu items and unpublish the Cotton and Shuttle components, since unpublishing the menu item alone does not close the task endpoints.
Affected versions: < 2.0.2
Full advisory: www.cve.org