MaxSite CMS CVE-2025-12346

Exploitation requires valid authentication credentials with admin or plugin-access privileges on the MaxSite CMS installation. Specifically, an attacker must be able to access the auto_post plugin's upload functionality (/application/maxsite/admin/plugins/auto_post/ or equivalent). The vulnerability is triggered when the attacker manipulates the HTTP request headers X-Requested-FileName and X-Requested-FileUpDir during file upload operations. No special system configuration or non-default settings are explicitly described in available data, suggesting the default plugin behavior is vulnerable. The admin panel and auto_post plugin must be installed and enabled (appears to be default for MaxSite CMS versions up to 109). Unauthenticated remote exploitation is NOT possible - a valid login is required.

CVSS 2.1 with authenticated-required attack (PR:L) reflects limited severity, but data signals warrant nuanced analysis. EPSS at 0.05% percentile (16th percentile) indicates very low exploitation probability in the wild, contradicting the 'public exploit available' claim - suggesting the POC may be academic, version-specific, or dependent on non-default configuration. The vulnerability requires authenticated access (PR:L per CVSS 4.0 vector), which significantly reduces opportunistic attack surface compared to unauthenticated exploits. However, many MaxSite CMS deployments may have weak or default credentials, lowering the practical barrier to initial access. The authenticated-only requirement and low EPSS score together suggest this is a lower-priority finding for organizations with strong access controls and regular patching practices. Organizations with MaxSite CMS and exposed admin interfaces or weak authentication are at elevated risk.

An attacker with valid (but low-privilege) admin credentials logs into the MaxSite CMS admin panel and navigates to the auto_post plugin upload feature. Instead of uploading files through the normal UI, the attacker crafts HTTP requests with custom headers X-Requested-FileName and X-Requested-FileUpDir set to malicious values, such as a path to the web root and a PHP filename. The vulnerable upload handler fails to properly validate these headers and stores the uploaded file in the attacker's chosen location with the attacker's chosen filename, enabling webshell deployment or overwriting legitimate files.