Is there a public PoC exploit available for CVE-2025-12346?

Yes, a public proof-of-concept exploit is available for CVE-2025-12346. Prioritise patching immediately. EPSS: 0.1%.

MaxSite CMS CVE-2025-12346

Q: What is the CVSS score of CVE-2025-12346?

CVE-2025-12346 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Access Control (CWE-284)

2025-10-28 cna@vuldb.com

PHP Authentication Bypass File Upload Maxsite Cms

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:34 vuln.today

DescriptionCVE.org

A vulnerability was detected in MaxSite CMS up to 109. This vulnerability affects unknown code of the file application/maxsite/admin/plugins/auto_post/uploads-require-maxsite.php of the component HTTP Header Handler. Performing manipulation of the argument X-Requested-FileName/X-Requested-FileUpDir results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

MaxSite CMS up to version 109 contains an unrestricted file upload vulnerability in the auto_post plugin's upload handler that allows authenticated remote attackers to bypass file upload restrictions by manipulating HTTP headers (X-Requested-FileName and X-Requested-FileUpDir). Public exploit code is available, though EPSS score (0.05%) suggests limited real-world exploitation despite the publicly disclosed proof-of-concept.

Technical ContextAI

The vulnerability exists in the HTTP Header Handler component (application/maxsite/admin/plugins/auto_post/uploads-require-maxsite.php) which improperly validates or sanitizes custom HTTP headers used for file upload operations. CWE-284 (Improper Access Control / Incorrect Permission Assignment) indicates the root cause is inadequate authorization checks on the header parameters that control upload destination and filename. The auto_post plugin appears designed to automate content posting and relies on header-based directives to determine where files should be stored and what names they should receive. MaxSite CMS is a PHP-based content management system, and this plugin vulnerability allows attackers with valid credentials to manipulate upload behavior outside intended boundaries.

RemediationAI

Update MaxSite CMS to a version newer than 109 if available from the vendor. Since the vendor did not respond to early disclosure according to the report, check the official MaxSite project repository or community channels for available updates. As an immediate workaround, disable or restrict access to the auto_post plugin administratively if it is not actively used, or apply strict network access controls to limit admin panel exposure to trusted IP ranges only. Additionally, implement strict input validation on custom HTTP headers (X-Requested-FileName and X-Requested-FileUpDir) by filtering special characters, path traversal sequences, and validating filenames against a whitelist. Monitor file upload directories for unexpected files or suspicious activity. If no patched version becomes available from the unmaintained project, consider migrating to an actively maintained CMS with documented security practices.