CVE-2026-87930: MaxSite CMS through 109.6 PHP Object Injection via ci_session
MaxSite CMS through 109.6 passes the cisession cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve code execution if gadget classes exist.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. Exploitation requires forging a valid ci_session cookie with the hardcoded encryption key and a usable PHP object gadget chain that invokes dangerous magic methods.
Are default deployments exposed?
The affected behavior is the use of a hardcoded encryption key and unrestricted unserialize() processing of the ci_session cookie. Deployments running MaxSite CMS through 109.6 should be treated as exposed where this session handling is present.
What is the impact if a suitable gadget chain exists?
A forged session cookie can inject PHP objects and trigger magic methods. This may corrupt application state or lead to code execution, depending on the classes available in the application.