CVE-2026-70554

Summary

MaxSite CMS is vulnerable to PHP object injection, allowing unauthenticated attackers to execute arbitrary code via a malicious serialized PHP object in the maxsite_comuser cookie.

Exploitability

Exploitation is relatively straightforward as attackers can craft a payload in a single HTTP request, but requires the attacker to have control over the cookie value.

Blast radius

If exploited, this vulnerability could result in full remote code execution on the affected server, potentially leading to data theft, service disruption, or complete compromise of the system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the affected feature or restrict access to the maxsite_comuser cookie to prevent unauthenticated attackers from injecting PHP objects.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.