CVE-2026-70554

Received Received - Intake

PHP Object Injection in MaxSite CMS

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: VulnCheck

Description

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowlisting. Attackers can craft a malicious serialized PHP object payload delivered in a single HTTP request to trigger magic methods during object graph reconstruction, enabling property-oriented programming attacks or remote code execution via available gadget chains such as those targeting SoapClient or Imagick extensions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-04

Generated

2026-08-05

AI Q&A

2026-08-05

EPSS Evaluated

N/A

NVD

CVE-2026-70554

EUVD

EUVD-2026-52894

Affected Vendors & Products

Vendor	Product	Version / Range
maxsite	maxsite_cms	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

MaxSite CMS has a PHP object injection flaw where unauthenticated attackers can execute arbitrary code by sending malicious serialized data in the maxsite_comuser cookie. The unserialize() function processes this data without validation, allowing attackers to craft a payload that triggers dangerous magic methods during object reconstruction, leading to remote code execution via gadget chains like SoapClient or Imagick.

Detection Guidance

Detecting this vulnerability requires inspecting HTTP requests for the maxsite_comuser cookie containing serialized PHP objects. Monitor web server logs for unusual cookie values or requests to MaxSite CMS endpoints. Use tools like Burp Suite or Wireshark to capture and analyze traffic for serialized data in cookies.

Impact Analysis

An attacker could exploit this to take full control of your MaxSite CMS server, steal sensitive data, install malware, or disrupt services. Since no authentication is required, any internet-facing instance is at immediate risk of compromise.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized data access or processing, and HIPAA if patient data is exposed. Organizations must patch immediately to avoid regulatory fines, data breach notifications, and reputational damage.

Mitigation Strategies

Immediately update MaxSite CMS to the latest patched version. Disable the maxsite_comuser cookie if not required. Implement input validation to reject serialized data in cookies. Use allowlisting for unserialize() to restrict allowed classes. Monitor for suspicious activity or unauthorized code execution.

Hi! I’m here to help you understand CVE-2026-70554. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70