Cotonti Siena 0.9.26 and earlier is vulnerable to a CSRF attack due to missing CSRF validation in the admin.php configuration update handler. An attacker can trick a logged-in administrator into submitting a forged POST request that modifies configuration parameters, specifically setting 'pfsfilecheck' to 0. This disables the PFS module's file extension whitelist, allowing users with PFS access to upload and execute arbitrary PHP files, potentially leading to remote code execution. The vulnerability does not require authentication and impacts the integrity and availability of the affected system.

Successful exploitation allows unauthenticated attackers to modify administrator configuration settings via CSRF, disabling critical security controls in the PFS module. This enables arbitrary PHP file uploads and execution by users with PFS access, which can lead to remote code execution on the server, compromising system integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access and avoid logging in to the administration interface from untrusted networks or browsers. Monitor for unusual configuration changes and consider disabling or restricting PFS module access as a temporary mitigation.