Read the docs
TI-2026-02931 Aliases CVE-2026-3395GHSA-g6fv-7p3q-j4fc

MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection

Priority HIGH 70CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 109.2 will fix this issue. This patch is called 08937a3c5d672a242d68f53e9fccf8a748820ef3. You should upgrade the affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.04021 90th percentileScored 2026-11-07
Fix Fixed CMS (MaxSite): 109.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MaxSiteCMS109.0; 109.1109.2Patch availableCNA
  • CMS VendorMaxSite Affected 109.0; 109.1 Fixed in 109.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:max-3000:maxsite_cms:*:*:*:*:*:*:*:*before 109.2VulnerableMax-3000
  • cpe:2.3:a:max-3000:maxsite_cms:*:*:*:*:*:*:*:* Versions before 109.2 Vulnerable ·Max-3000

Remediation

  • Fix · CNA CMS (MaxSite) Fixed in 109.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-3395
  2. 2026-10-03 Alias added: GHSA-g6fv-7p3q-j4fc
  3. 2026-10-25 EPSS moved to the 90th–95th percentile

References

Patch 1

Other 1

  • TI-2026-59994 MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key CVSS 4.0CRITICAL 9.3
  • TI-2026-59992 MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher CVSS 4.0HIGH 8.8
  • TI-2026-59995 MaxSite CMS through 109.6 PHP Object Injection via ci_session CVSS 4.0CRITICAL 9.2
  • TI-2025-11324 MaxSite CMS save-file-ajax.php unrestricted upload CVSS 4.0MEDIUM 5.3
  • TI-2026-06140 MaxSite CMS ushki Plugin cross site scripting CVSS 4.0MEDIUM 4.8
  • TI-2026-06139 MaxSite CMS Guestbook Plugin cross site scripting CVSS 4.0MEDIUM 4.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences