A critical (CVSS 9.8) code injection flaw lets unauthenticated attackers write arbitrary PHP into MaxSite CMS's database configuration file, yielding persistent remote code execution as the web-server user.
What Is It
CVE-2026-70553 is a remote code execution vulnerability in MaxSite CMS. The install endpoint remains reachable after installation is complete, and it accepts crafted POST requests from unauthenticated clients. An attacker supplies a db_dbprefix value containing a single quote, breaking out of the PHP string literal written into application/config/database.php. Arbitrary PHP statements can then be appended to that config file.
Because the config file is included on every request, the injected code executes each time the application loads; turning a single POST into a persistent backdoor running as the web-server process user. It is tracked as CWE-94 (Improper Control of Generation of Code).
Why It Matters
The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability. CVSS v4.0 scores it 9.3 (CRITICAL). There is no authentication barrier and nothing for a victim to click.
The persistence angle is what raises this above a typical injection bug: the payload lives in a config file, not in memory, so it survives restarts and continues executing until the file is cleaned. Patching alone does not remove code already written to disk.
No CISA KEV entry was supplied for this CVE, so there is no confirmed evidence of active exploitation in the supplied source material and no KEV-mandated remediation deadline.
What's Vulnerable
- Vendor/Product: MaxSite; MaxSite CMS
- Affected: versions 105.2 through 109.5 (inclusive)
- Not affected: version 109.6
Patch Status
MaxSite CMS 109.6 is listed as unaffected and is the fixed release. Operators running 105.2–109.5 should upgrade to 109.6. Given that exploitation writes attacker code into application/config/database.php, upgrading should be paired with inspecting that file for injected PHP on any host that may have been reachable while vulnerable.
Sources
- NVD, CVE-2026-70553: https://nvd.nist.gov/vuln/detail/CVE-2026-70553
- VulnCheck Advisory; MaxSite CMS Unauthenticated RCE via Install Endpoint: https://www.vulncheck.com/advisories/maxsite-cms-unauthenticated-rce-via-install-endpoint
- MaxSite CMS 109.6 Release Notes: https://max-3000.com/page/maxsite-cms-109-6
- MaxSite CMS Source Repository: https://github.com/maxsite/cms