CVE-2026-70554
CriticalCVSS 9.8Summary
MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation. Attackers can use gadget chains such as SoapClient or Imagick for remote code execution.
Risk Assessment
Risk of full web server compromise, data theft, and further attacks within the infrastructure.
Recommendation
Upgrade MaxSite CMS to the latest version. If not available, restrict access to the admin panel and monitor for unusual HTTP requests.
Original NVD description (English source)
MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowlisting. Attackers can craft a malicious serialized PHP object payload delivered in a single HTTP request to trigger magic methods during object graph reconstruction, enabling property-oriented programming attacks or remote code execution via available gadget chains such as those targeting SoapClient or Imagick extensions.