{"id":"CVE-2026-70554","title":"MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie","summary":"MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without vali…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-502"],"vendor":"MaxSite","product":"MaxSite CMS","affected":["cms >= 0.78 <= 109.5"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-08-05T13:52:48.956931Z"},"published":"2026-08-04","updated":"2026-09-24","sourceUpdated":"2026-09-24T14:18:36.342Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-70554","references":[{"url":"https://github.com/maxsite/cms","label":"Product Repository"},{"url":"https://max-3000.com/page/maxsite-cms-109-6","label":"Patch Commit"},{"url":"https://www.vulncheck.com/advisories/maxsite-cms-unauthenticated-php-object-injection-via-maxsite-comuser-cookie"}],"tags":["cve.org"],"epss":0.00851,"epssPercentile":0.56692,"ingestedAt":"2026-09-24T15:45:56.716Z","slug":"CVE-2026-70554","body":"## Overview\n\nMaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowlisting. Attackers can craft a malicious serialized PHP object payload delivered in a single HTTP request to trigger magic methods during object graph reconstruction, enabling property-oriented programming attacks or remote code execution via available gadget chains such as those targeting SoapClient or Imagick extensions.\n\n## Affected\n\n- `cms >= 0.78 <= 109.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}