Read the docs
TI-2026-49276 Aliases CVE-2026-70554GHSA-jm66-348j-qvv2

MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie

Priority MEDIUM 51CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowlisting. Attackers can craft a malicious serialized PHP object payload delivered in a single HTTP request to trigger magic methods during object graph reconstruction, enabling property-oriented programming attacks or remote code execution via available gadget chains such as those targeting SoapClient or Imagick extensions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01233 69th percentileScored 2026-11-07
Fix Fixed MaxSite CMS (MaxSite): 109.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MaxSiteMaxSite CMS0.78 – 109.5109.6Patch availableCNA
  • MaxSite CMS VendorMaxSite Affected 0.78 – 109.5 Fixed in 109.6 Patch available CNA

Remediation

  • Fix · CNA MaxSite CMS (MaxSite) Fixed in 109.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-70554
  2. 2026-10-03 Alias added: GHSA-jm66-348j-qvv2

References

Patch 1

Other 1

  • TI-2026-59994 MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key CVSS 4.0CRITICAL 9.3
  • TI-2026-59992 MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher CVSS 4.0HIGH 8.8
  • TI-2026-59995 MaxSite CMS through 109.6 PHP Object Injection via ci_session CVSS 4.0CRITICAL 9.2
  • TI-2026-02931 MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection CVSS 4.0MEDIUM 6.9
  • TI-2025-11324 MaxSite CMS save-file-ajax.php unrestricted upload CVSS 4.0MEDIUM 5.3
  • TI-2026-06140 MaxSite CMS ushki Plugin cross site scripting CVSS 4.0MEDIUM 4.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences