MaxSite CMS CVE-2026-87927

The target must be running MaxSite CMS version 0.78 through 109.6 with the web-accessible dispatcher endpoints (application/views/ajax.php or application/views/require-maxsite.php) reachable over HTTP or HTTPS. No authentication is required and no non-default configuration is needed - these dispatcher files are present and externally accessible in a standard MaxSite CMS installation. The attacker must supply a base64-encoded path traversal payload as the handler-selection parameter; a public PoC reduces the technical skill required to near zero. Exploitation is limited to the set of PHP handler files present on the server filesystem that are reachable via traversal from the dispatcher's base path; the practical impact depends on which privileged admin handler files exist and what actions they expose.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N, score 8.8) aligns well with the described behavior: unauthenticated, network-reachable, low-complexity exploitation with high integrity impact. The VC:L (low confidentiality) metric is plausible if the primary exposed capability is executing admin actions rather than directly dumping arbitrary file contents, though LFI primitives can often be chained to read PHP source or configuration files - this nuance is not fully resolved by the description alone. Real-world risk is elevated substantially by the existence of a public PoC exploit (published 2026-09-08 by EviL0rd) and the fact that the affected version range covers the entire product history, leaving no safe version to downgrade to. EPSS score is not provided in the input data, and the vulnerability is not listed in CISA KEV, so exploitation at scale is not confirmed; however, the trivially low attack complexity and freely available PoC lower the bar to automated scanning campaigns. The absence of a confirmed patch further amplifies urgency for any exposed deployment.

An unauthenticated attacker sends a crafted HTTP GET or POST request to the MaxSite CMS ajax dispatcher endpoint, supplying a base64-encoded path traversal string (e.g., base64('../../../admin/handlers/settings')) as the file selection parameter. The dispatcher validates the encoded string (which appears innocuous to the path check), then decodes it and resolves the traversal to a privileged admin handler PHP file, which is then included and executed in the request context. Using the publicly available PoC published 2026-09-08 at https://github.com/EviL0rd/maxsite-cve1/blob/main/2026.09.08-maxsite-cms-ajax-lfi-path-traversal.md, the attacker can enumerate and invoke admin-gated functionality such as account management or configuration changes without any credentials.