Critical PHP Injection Flaw in MaxSite CMS

MaxSite CMS contains a critical PHP object injection vulnerability identified as CVE-2026-70554. With a CVSS score of 9.8, this flaw allows unauthenticated attackers to execute arbitrary code on affected systems by manipulating the maxsite_comuser cookie.

The vulnerability stems from the application passing attacker-controlled serialized data directly to the unserialize() function without any validation or class allowlisting. This oversight enables remote code execution through the reconstruction of malicious object graphs.

What's at Risk

The vulnerability affects MaxSite CMS installations that rely on the maxsite_comuser cookie for session management. Organizations running internet-facing instances of this CMS are at the highest risk, as the flaw does not require authentication to exploit.

Because the vulnerability allows for arbitrary code execution, an attacker who successfully exploits this flaw gains the ability to compromise the underlying server. This could lead to full system takeover, data exfiltration, or the deployment of additional malicious payloads within the host environment.

How the Flaw Works

PHP object injection is a vulnerability that occurs when user-supplied input is passed to the unserialize() function. In general terms, this allows an attacker to inject objects into the application scope. If the application includes certain classes with magic methods, such as __destruct or __wakeup, the attacker can manipulate the state of these objects to trigger unintended actions.

By chaining these objects together—a technique known as property-oriented programming—attackers can often achieve remote code execution. This typically involves leveraging existing code within the application or its extensions, such as SoapClient or Imagick, to perform actions the developer never intended, such as file system manipulation or unauthorized network requests.

How to Protect Your Systems

• Monitor the official MaxSite CMS repository for patch releases and apply updates immediately upon availability.
• Restrict network access to the application by placing it behind a web application firewall that can inspect and block malicious serialized payloads in cookies.
• Conduct a thorough audit of server logs to identify any anomalous activity or attempts to inject serialized objects into HTTP requests.
• Implement strict input validation and avoid passing untrusted data directly to serialization functions in custom code.
• Follow the principle of least privilege by running the web server process with the minimum permissions necessary to function.

Given the critical severity of this vulnerability and the ease with which it can be exploited by unauthenticated actors, immediate attention is required. Administrators should prioritize identifying exposed instances and applying security updates as soon as they are provided by the vendor to prevent potential system compromise.