MaxSite CMS through 109.6 PHP Object Injection via ci_session
Priority HIGH 75CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.
Summary
MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve code execution if gadget classes exist.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00606 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-87930
- 2026-10-03 Alias added: GHSA-2phq-cm26-22pm
References
Other 5
- https://github.com/maxsite/cms
- https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/system/libraries/Session.php#L670-L680
- https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/system/libraries/Session.php#L740-L742
- https://github.com/EviL0rd/maxsite-cve4/blob/main/2026.09.08-maxsite-cms-hardcoded-session-key-auth-bypass.md
- https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/application/config/config.php#L230-L254
More MaxSite vulnerabilities
- TI-2026-59994 MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key CVSS 4.0CRITICAL 9.3
- TI-2026-59992 MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher CVSS 4.0HIGH 8.8
- TI-2026-02931 MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection CVSS 4.0MEDIUM 6.9
- TI-2025-11324 MaxSite CMS save-file-ajax.php unrestricted upload CVSS 4.0MEDIUM 5.3
- TI-2026-06140 MaxSite CMS ushki Plugin cross site scripting CVSS 4.0MEDIUM 4.8
- TI-2026-06139 MaxSite CMS Guestbook Plugin cross site scripting CVSS 4.0MEDIUM 4.8
Sources
- CVE-2026-87930 · CVE Program
- CVE-2026-87930 · NVD
- FIRST EPSS
- GHSA-2phq-cm26-22pm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences