CVE-2026-70554: MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie
MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize() without validation or class allowlisting. Attackers can craft a malicious serialized PHP object payload delivered in a single HTTP request to trigger magic methods during object graph reconstruction, enabling property-oriented programming attacks or remote code execution via available gadget chains such as those targeting SoapClient or Imagick extensions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70554?
The severity of CVE-2026-70554 is critical with a CVSS score of 9.3.
How do I fix CVE-2026-70554?
To fix CVE-2026-70554, ensure that updates for MaxSite CMS are applied and validate or restrict input in the maxsite_comuser cookie before unserializing.
What impact could CVE-2026-70554 have on my system?
CVE-2026-70554 could allow unauthenticated attackers to execute arbitrary code on your system due to PHP object injection.
Which versions of MaxSite CMS are affected by CVE-2026-70554?
CVE-2026-70554 affects multiple versions of MaxSite CMS where the vulnerability is present in the handling of the maxsite_comuser cookie.
Is authentication required to exploit CVE-2026-70554?
No, CVE-2026-70554 can be exploited by unauthenticated attackers.