Which versions of MaxSite CMS are affected by CVE-2026-70553?

MaxSite CMS contains a critical unauthenticated remote code execution vulnerability (CVE-2026-70553, CVSS 9.3) that allows attackers to inject malicious PHP code into the application's configuration…. A patch is available.

How to fix or mitigate CVE-2026-70553?

Within 24 hours, apply the vendor patch to all MaxSite CMS instances immediately, or isolate affected systems from production networks if patching cannot be completed urgently. Within 7 days, verify patch deployment across your entire MaxSite CMS infrastructure and implement application-level access controls to restrict database configuration endpoints. Within 30 days, conduct a comprehensive security audit of all affected systems to identify signs of prior exploitation, review web server access logs for suspicious database.php modifications, and implement intrusion detection signatures specific to this attack pattern.

MaxSite CMS CVE-2026-70553

Q: What is the CVSS score of CVE-2026-70553?

CVE-2026-70553 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-52913 CRITICAL

Code Injection (CWE-94)

2026-08-04 VulnCheck

GHSA-32g8-v8qx-8c7w

PHP RCE Code Injection Maxsite Cms Maxsite

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated remote POST with no user interaction (AV:N/AC:L/PR:N/UI:N) yields arbitrary PHP execution, fully compromising confidentiality, integrity, and availability of the host application (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 20:35 vuln.today

CVE Published

Aug 04, 2026 - 19:37 cve.org

CRITICAL 9.3

DescriptionCVE.org

MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious db_dbprefix value containing a single quote to break out of a PHP string literal in application/config/database.php, appending attacker-controlled PHP statements that are executed by the web server on every subsequent request, resulting in persistent unauthenticated remote code execution as the web-server process user.

AnalysisAI

Persistent unauthenticated remote code execution in MaxSite CMS lets attackers POST a crafted db_dbprefix value to the install endpoint even after installation is complete, injecting attacker-controlled PHP into application/config/database.php that executes on every subsequent request. Reported by VulnCheck with a vendor patch available and rated CVSS 4.0 9.3 (AV:N/AC:L/PR:N/UI:N), it grants code execution as the web-server process user; no public exploit identified at time of analysis, though the advisory describes the technique in detail.

Technical ContextAI

MaxSite CMS is a PHP-based content management system that persists its configuration as executable PHP source files rather than inert data. The flaw is a classic CWE-94 Code Injection: the installer writes the user-supplied db_dbprefix directly into a single-quoted PHP string literal in application/config/database.php without escaping. A single quote in the input closes the literal early, and any text after it is interpreted as PHP code when the config file is include()'d on each request. The install endpoint failing to disable itself post-installation (a missing installed-state guard) is what exposes this to unauthenticated callers. The single affected product is identified by cpe:2.3:a:maxsite:maxsite_cms:*:*:*:*:*:*:*:*.

RemediationAI

Patch available per vendor advisory - upgrade to the fixed MaxSite CMS release referenced at https://max-3000.com/page/maxsite-cms-109-6 (the advisory page corresponds to the 1.9.6 fix line; confirm the exact tagged version against the vendor page before deploying, as an exact fix version was not independently supplied in the input). As immediate compensating controls until patched: delete or web-server-restrict the install directory/endpoint so it returns 403/404 to unauthenticated clients (trade-off: blocks legitimate re-installation), and make application/config/database.php read-only to the web-server user to prevent config rewrites (trade-off: breaks legitimate config updates through the UI). Additionally, inspect application/config/database.php now for injected PHP after the db_dbprefix value, since exploitation is persistent and a fix alone will not remove an already-planted backdoor. Cross-reference the VulnCheck advisory at https://www.vulncheck.com/advisories/maxsite-cms-unauthenticated-rce-via-install-endpoint for the affected endpoint path.