A critical deserialization flaw in MaxSite CMS lets unauthenticated attackers reach unserialize() through the maxsite_comuser cookie, potentially opening a path to remote code execution in a single HTTP request.
What Is It
MaxSite CMS passes attacker-controlled serialized data from the maxsite_comuser cookie directly to unserialize() with no validation and no class allowlisting. That is a textbook CWE-502 (Deserialization of Untrusted Data) condition.
An attacker crafts a malicious serialized PHP object payload and delivers it in the cookie. During object graph reconstruction, PHP invokes magic methods on the reconstructed objects, which enables property-oriented programming (POP) attacks. Where suitable gadget chains are present, the advisory cites chains targeting the SoapClient or Imagick extensions, this can escalate to remote code execution. The severity of a given install therefore depends in part on which extensions and gadget-bearing classes are loaded.
Why It Matters
The CVSS v3.1 base score is 9.8 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS v4.0 score from the same source is 9.3 (CRITICAL).
Every exploitability factor is at its worst setting: network attack vector, low complexity, no privileges required, and no user interaction. Confidentiality, integrity, and availability impacts are all HIGH. The attack takes a single HTTP request with a forged cookie; no account, no login, no victim clicking anything. That combination lends itself to scripted, opportunistic attempts against internet-facing installs.
CVE-2026-70554 does not appear in the CISA Known Exploited Vulnerabilities catalog (linked below) as of this writing, so no KEV remediation deadline applies to federal civilian agencies. Absence from KEV is not itself evidence that exploitation is not occurring; it reflects only what CISA has catalogued to date, and readers should re-check the catalog directly, since it is updated on an ongoing basis.
What's Vulnerable
- Vendor: MaxSite
- Product: MaxSite CMS
- Affected: versions 0.78 through 109.5, inclusive
- Not affected: version 109.6
Patch Status
Version 109.6 is listed as unaffected and appears to be the fixed release. Operators running anything in the 0.78–109.5 range should upgrade to 109.6.
The record was published 2026-08-04 by VulnCheck ([email protected]) and currently carries NVD status Received, meaning NVD enrichment and analysis are still pending.
Sources
- NVD, CVE-2026-70554: https://nvd.nist.gov/vuln/detail/CVE-2026-70554
- VulnCheck Advisory; MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie: https://www.vulncheck.com/advisories/maxsite-cms-unauthenticated-php-object-injection-via-maxsite-comuser-cookie
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- MaxSite CMS 109.6 Release Page: https://max-3000.com/page/maxsite-cms-109-6
- MaxSite CMS Source Repository: https://github.com/maxsite/cms