Vulnerability · Published Aug 4, 2026 · Assigned by VulnCheck

CVE-2026-70553MaxSite CMS Unauthenticated RCE via Install Endpoint

Critical 9.8

In plain English

A critical-severity code injection in MaxSite CMS from MaxSite. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.3%top 30.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious db_dbprefix value containing a single quote to break out of a PHP string literal in application/config/database.php, appending attacker-controlled PHP statements that are executed by the web server on every subsequent request, resulting in persistent unauthenticated remote code execution as the web-server process user.

Affected products (as reported)

Vendor	Product	Versions
MaxSite	MaxSite CMS	105.2 – through 109.5

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Product Repository product
Patch Commit patch
https://www.vulncheck.com/advisories/maxsite-cms-unauthenticated-rce-via-install-endpoint third-party-advisory