Cotonti Siena 0.9.26 and earlier is affected by a stored cross-site scripting vulnerability (CWE-79) where authenticated users with PFS access can supply malicious HTML in the ntitle parameter. The parameter is processed through the TXT filter in pfs.main.php but does not properly escape script tags, resulting in stored XSS. This enables execution of arbitrary scripts in the context of any user viewing the folder listing, including privileged users such as administrators.

The vulnerability allows authenticated users with PFS access to inject and store malicious scripts in folder titles. These scripts execute in the browsers of any users who view the affected folder listings, potentially leading to session hijacking, privilege escalation, or other malicious actions within the affected application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict PFS access to trusted users only and consider additional input validation or output encoding on the ntitle parameter as a temporary mitigation.