CVE-2026-87928: Malicious File Upload
MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers when the file is accessed, enabling persistent stored cross-site scripting attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Until upgraded, restrict upload capability to prevent any logged-in user from uploading HTML to the uploads/_pages/ directory (e.g., restrict/limit admin_page upload handler permissions to trusted roles only).
Event History
Frequently Asked Questions
Which deployments are affected?
MaxSite CMS versions 0.94 through 109.6 are affected. The issue is in the admin_page upload handler.
What access does an attacker need to exploit this?
An attacker needs to be logged in to upload an HTML file through the vulnerable handler. A visitor must then access the uploaded file for its embedded script to execute in that visitor's browser.
Where can defenders look for potentially malicious uploads?
Review HTML files in the uploads/_pages/ directory, which is the location used by the vulnerable upload path. Files in that directory that contain scripts may be used for persistent cross-site scripting.