Which versions of MaxSite CMS are affected by CVE-2026-70554?

MaxSite CMS contains a critical vulnerability enabling unauthenticated remote code execution and complete system compromise through a single malicious request.. A patch is available.

How to fix or mitigate CVE-2026-70554?

Within 24 hours, inventory all MaxSite CMS deployments, identify internet-facing systems, and document current version numbers. Within 7 days, deploy MaxSite CMS 109.6 to all instances, prioritizing production systems and scheduling deployments during maintenance windows to minimize operational impact. Within 30 days, confirm 100% patch compliance across the enterprise, review web access logs for exploitation attempts, and document remediation completion.

MaxSite CMS CVE-2026-70554

Q: What is the CVSS score of CVE-2026-70554?

CVE-2026-70554 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-52894 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-04 VulnCheck

GHSA-jm66-348j-qvv2

PHP RCE Deserialization Maxsite Cms Maxsite

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated single-request cookie injection to unserialize() gives network vector, low complexity, no privileges or interaction; RCE via gadget yields full C/I/A impact within the vulnerable component.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 21:00 vuln.today

CVE Published

Aug 04, 2026 - 20:11 cve.org

CRITICAL 9.3

DescriptionCVE.org

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowlisting. Attackers can craft a malicious serialized PHP object payload delivered in a single HTTP request to trigger magic methods during object graph reconstruction, enabling property-oriented programming attacks or remote code execution via available gadget chains such as those targeting SoapClient or Imagick extensions.

AnalysisAI

Unauthenticated remote code execution in MaxSite CMS is possible because the application passes attacker-controlled serialized data from the maxsite_comuser cookie directly into PHP's unserialize() without validation or class allowlisting. Any remote attacker can send a single crafted HTTP request carrying a malicious serialized PHP object to trigger property-oriented programming (POP) gadget chains and execute arbitrary code. The flaw was reported by VulnCheck and a vendor patch is available (MaxSite CMS 109.6); no public exploit code or CISA KEV listing is identified at time of analysis, though the CVSS 4.0 score of 9.3 reflects trivially triggerable, high-impact exploitation.

Technical ContextAI

The vulnerability is a classic CWE-502 (Deserialization of Untrusted Data) PHP object injection issue. MaxSite CMS is an open-source PHP content management system (cpe:2.3:a:maxsite:maxsite_cms). The affected code path reads the maxsite_comuser cookie - a value fully controlled by the client - and feeds it to PHP's native unserialize() function. When PHP reconstructs an object graph from serialized input, it instantiates objects of arbitrary declared classes and invokes their 'magic methods' (such as __wakeup, __destruct, __toString). Without a class allowlist (the allowed_classes option of unserialize), an attacker can force instantiation of any loadable class and chain their magic-method side effects into a POP gadget chain. Well-known universal gadgets in the PHP ecosystem - such as those built on the SoapClient (SSRF/request forgery) or the Imagick extension (which offers documented RCE gadget chains) - turn the injection into code execution rather than mere object instantiation.

RemediationAI

Vendor-released patch: upgrade to MaxSite CMS 109.6 or later, per the vendor advisory at https://max-3000.com/page/maxsite-cms-109-6; source and releases are available at https://github.com/maxsite/cms and the vulnerability details at https://www.vulncheck.com/advisories/maxsite-cms-unauthenticated-php-object-injection-via-maxsite-comuser-cookie. If immediate patching is not possible, apply compensating controls at the web/application layer: use a WAF or reverse-proxy rule to strip or reject the maxsite_comuser cookie (side effect - breaks any legitimate comment-user session state relying on that cookie), and where the code cannot be updated, replace the raw unserialize() call with json-based decoding or pass allowed_classes=false to unserialize() to block object instantiation entirely (side effect - any legitimate serialized objects in that cookie will fail to hydrate). Additionally, remove or disable unnecessary PHP extensions such as Imagick and the SOAP client on the server to eliminate common RCE gadget chains (side effect - features depending on image processing or SOAP will break).