CVE-2026-70553
Received Received - Intake

Remote Code Execution in MaxSite CMS

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: VulnCheck

Description
MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious db_dbprefix value containing a single quote to break out of a PHP string literal in application/config/database.php, appending attacker-controlled PHP statements that are executed by the web server on every subsequent request, resulting in persistent unauthenticated remote code execution as the web-server process user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-05
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-70553
EUVD
EUVD-2026-52913

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
maxsite maxsite_cms From 105.2 (inc) to 109.5 (inc)
maxsite maxsite_cms *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MaxSite CMS has a remote code execution vulnerability where unauthenticated attackers can inject arbitrary PHP code into the application configuration file. This is done by sending crafted POST requests to the install endpoint after installation, exploiting the db_dbprefix parameter to break out of a PHP string literal in application/config/database.php. The injected code executes on every request, giving attackers persistent unauthenticated remote code execution as the web server process user.

Detection Guidance

Check MaxSite CMS versions between 105.2 and 109.5. Inspect POST requests to the install endpoint for db_dbprefix parameters containing single quotes or PHP code injection attempts. Review application/config/database.php for unexpected PHP statements appended to the db_dbprefix value.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your server without authentication. They can take full control of your MaxSite CMS installation, steal sensitive data, modify or delete files, install malware, or use your server for further attacks. The impact includes complete system compromise and potential lateral movement within your network.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized access to personal or health data. GDPR mandates protection of personal data, while HIPAA requires safeguards for protected health information. A successful exploit could lead to data breaches, resulting in regulatory fines, legal liabilities, and reputational damage for affected organizations.

Mitigation Strategies

Upgrade MaxSite CMS to a version beyond 109.5 if available. If not, restrict access to the install endpoint via web server rules. Remove or disable the install endpoint after installation. Monitor logs for suspicious POST requests to the install endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70553. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart