MaxSite CMS Critical RCE Flaw Discovered

MaxSite CMS contains a critical remote code execution vulnerability, identified as CVE-2026-70553, which allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file. By submitting crafted POST requests to the install endpoint even after the installation process is complete, an attacker can gain full control over the web server process.

What's at Risk

The vulnerability affects MaxSite CMS and carries a CVSS 3.1 score of 9.8, classifying it as critical. Organizations running internet-facing deployments of this software are at the highest risk, as the flaw does not require authentication to exploit. Because the exploit results in persistent code execution, any server running the software is a potential target for full system compromise.

How the Flaw Works

This vulnerability is a form of code injection, a class of security weakness that occurs when an application improperly handles user-supplied input before using it in a sensitive context. In this instance, the application fails to adequately sanitize the db_dbprefix value, allowing an attacker to break out of a PHP string literal. By injecting malicious syntax, the attacker can append arbitrary PHP statements to the application's database configuration file.

Once the malicious code is written to the file, the web server executes these injected commands every time the configuration is loaded. This pattern typically allows an attacker to bypass authentication, steal sensitive data, or establish a permanent foothold on the underlying host. Such flaws are dangerous because they transform legitimate application configuration mechanisms into vectors for unauthorized system access.

How to Protect Your Systems

• Review the MaxSite CMS official project repository for available security patches and apply them immediately.
• Restrict access to the installation endpoint by configuring web server rules to deny external requests to the setup directory.
• Ensure that the web server process runs with the least privilege necessary to perform its functions, limiting the potential impact of a successful compromise.
• Monitor server logs for unusual POST requests directed at installation or configuration endpoints.
• Implement strict file system permissions to ensure the application configuration files are not writable by the web server user after the initial setup is complete.

Given the critical severity of this vulnerability and the ease with which it can be exploited by unauthenticated actors, immediate remediation is essential. Leaving such a flaw unpatched provides attackers with a direct path to server-level execution, potentially leading to total loss of system integrity.