Vulnerability · Published Aug 4, 2026 · Assigned by VulnCheck
CVE-2026-70554MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie
Critical 9.8
In plain English
A critical-severity unsafe deserialization in MaxSite CMS from MaxSite. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).
Official description
MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowlisting. Attackers can craft a malicious serialized PHP object payload delivered in a single HTTP request to trigger magic methods during object graph reconstruction, enabling property-oriented programming attacks or remote code execution via available gadget chains such as those targeting SoapClient or Imagick extensions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MaxSite | MaxSite CMS | 0.78 – through 109.5 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H