Read the docs
TI-2026-49275 Aliases CVE-2026-70553GHSA-32g8-v8qx-8c7w

MaxSite CMS Unauthenticated RCE via Install Endpoint

Priority MEDIUM 51CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious db_dbprefix value containing a single quote to break out of a PHP string literal in application/config/database.php, appending attacker-controlled PHP statements that are executed by the web server on every subsequent request, resulting in persistent unauthenticated remote code execution as the web-server process user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01274 70th percentileScored 2026-11-07
Fix Fixed MaxSite CMS (MaxSite): 109.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MaxSiteMaxSite CMS105.2 – 109.5109.6Patch availableCNA
  • MaxSite CMS VendorMaxSite Affected 105.2 – 109.5 Fixed in 109.6 Patch available CNA

Remediation

  • Fix · CNA MaxSite CMS (MaxSite) Fixed in 109.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-70553
  2. 2026-10-03 Alias added: GHSA-32g8-v8qx-8c7w

References

Patch 1

Other 1

  • TI-2026-59994 MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key CVSS 4.0CRITICAL 9.3
  • TI-2026-59992 MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher CVSS 4.0HIGH 8.8
  • TI-2026-59995 MaxSite CMS through 109.6 PHP Object Injection via ci_session CVSS 4.0CRITICAL 9.2
  • TI-2026-02931 MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection CVSS 4.0MEDIUM 6.9
  • TI-2025-11324 MaxSite CMS save-file-ajax.php unrestricted upload CVSS 4.0MEDIUM 5.3
  • TI-2026-06140 MaxSite CMS ushki Plugin cross site scripting CVSS 4.0MEDIUM 4.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences