External risk intelligence

MaxSite CMS Unauthenticated Remote Code Execution via Install Endpoint

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-70553

MaxSite CMS is a web application designed to be internet-facing. The vulnerability exists in an endpoint that processes web requests. Web applications are commonly deployed as public-facing services, making this endpoint reachable from the internet in typical deployments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in MaxSite CMS that allows unauthenticated attackers to execute arbitrary code. The flaw resides in how the system handles post-installation configurations, enabling malicious input to alter application settings and lead to persistent remote code execution. This could allow an attacker to compromise the web server process.

Code execution flaw affects web applications.
Allows unauthenticated attackers to gain control.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can achieve remote code execution by sending a specially crafted POST request to the MaxSite CMS installation endpoint. This request manipulates the database prefix configuration to inject malicious PHP code, which is then executed by the web server, granting the attacker control.

No authentication or user interaction needed.
Injecting PHP via POST to install endpoint.
Persistent remote code execution.

Live Threat

Current exploitation, exposure, and threat context

MaxSite CMS allows unauthenticated attackers to execute arbitrary PHP code on the web server. This occurs when an attacker sends a specially crafted POST request to the installation endpoint after the initial setup is complete. The vulnerability lies in how a database prefix value is handled, enabling the injection and execution of malicious PHP statements that persist and run with every request.

Web server process user.
Inject malicious PHP code via POST request.
Persistent unauthenticated remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Attackers can exploit MaxSite CMS by submitting crafted POST requests to the install endpoint to inject arbitrary PHP code, leading to persistent remote code execution. The first practical step is to identify all instances of MaxSite CMS, determine their reachability and business criticality, and locate the accountable owner to plan remediation.

Identify affected technology instances.
Verify exposure and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MaxSite CMS?

MaxSite CMS is a PHP-based content management system used to build and manage websites. It provides a framework for site owners to organize pages, themes, and plugins. It is typically installed on web servers where it processes database connections and dynamic content requests.

What does CVE-2026-70553 mean for the software?

This vulnerability is classified as CWE-94: Improper Control of Generation of Code. In plain terms, the application fails to properly sanitize input before incorporating it into a configuration file. Because the system treats this user-supplied data as executable code, an attacker can insert their own commands, which the server will then run.

How does an attacker trigger this vulnerability?

An attacker sends a specific POST request to the application's installation endpoint. The exploit relies on injecting a character that breaks out of the expected data field, allowing the attacker to append malicious PHP statements. Notably, simply browsing the site or sending standard requests will not trigger the flaw; it requires a targeted, crafted submission to that specific endpoint.

Do I need to worry if my MaxSite CMS is internal?

Halo Surface Signal indicates that because MaxSite CMS is designed for web services, these instances are frequently deployed facing the internet. While internet-facing instances are at the highest risk, any reachable network path that allows a request to reach the installation endpoint could be used, so verify the network visibility of your specific deployment.

When should I take action for CVE-2026-70553?

Given the severity of the flaw, you should immediately inventory your environment to locate all instances of MaxSite CMS. Assess whether these instances are reachable over your network, determine which ones handle sensitive data or business functions, and contact the owners of these systems to prioritize them for security updates or isolation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.