CVE-2025-12346: MaxSite CMS RCE Vulnerability

CVE-2025-12346 Overview

CVE-2025-12346 is an unrestricted file upload vulnerability affecting MaxSite CMS versions up to 109. The flaw resides in application/maxsite/admin/plugins/auto_post/uploads-require-maxsite.php, within the HTTP Header Handler component. Attackers can manipulate the X-Requested-FileName and X-Requested-FileUpDir HTTP headers to upload arbitrary files to the server. Remote exploitation is possible with low-level authentication, and public exploit details are available. The vendor, max-3000, was contacted about the disclosure but did not respond. The vulnerability is classified under [CWE-284] Improper Access Control and [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated remote attackers can upload arbitrary files through manipulated HTTP headers, potentially enabling further compromise of MaxSite CMS installations.

Affected Products

MaxSite CMS versions up to and including 109
Component: application/maxsite/admin/plugins/auto_post/uploads-require-maxsite.php
Vendor: max-3000

Discovery Timeline

2025-10-28 - CVE-2025-12346 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12346

Vulnerability Analysis

The vulnerability exists in the auto_post plugin's file upload handler. The script uploads-require-maxsite.php accepts file upload parameters via custom HTTP request headers rather than validated form fields. Specifically, the X-Requested-FileName header controls the destination filename, while X-Requested-FileUpDir controls the target directory path. Neither header value is properly validated or restricted against dangerous file types or path traversal sequences. An authenticated attacker with low privileges can send a crafted HTTP request that writes attacker-controlled content to attacker-chosen locations on the web server.

The EPSS score is 0.357% with a percentile of 27.58, indicating limited observed exploitation activity, though public exploit information is available.

Root Cause

The root cause combines two weaknesses. First, the handler trusts client-supplied HTTP headers as authoritative input for file placement decisions ([CWE-284] Improper Access Control). Second, the handler fails to enforce an allowlist of permitted file extensions or content types before writing uploaded data to disk ([CWE-434] Unrestricted Upload of File with Dangerous Type). Together, these gaps allow arbitrary file writes into web-accessible directories.

Attack Vector

The attack requires network access to the MaxSite CMS admin interface and a valid low-privilege session. The attacker issues an HTTP request to the vulnerable endpoint including the X-Requested-FileName and X-Requested-FileUpDir headers set to attacker-chosen values. The server processes the upload without extension or path validation and stores the file at the attacker-controlled location. See the referenced Lab Note Sharing Link and VulDB #330136 for public technical details.

No verified proof-of-concept code has been included here. The vulnerability mechanism is described in prose based on the disclosure references above.

Detection Methods for CVE-2025-12346

Indicators of Compromise

HTTP requests to /application/maxsite/admin/plugins/auto_post/uploads-require-maxsite.php containing the headers X-Requested-FileName or X-Requested-FileUpDir.
Unexpected files with executable extensions (.php, .phtml, .phar) appearing under MaxSite CMS upload directories.
Directory traversal sequences such as ../ present in X-Requested-FileUpDir header values captured in web server logs.

Detection Strategies

Inspect web server and reverse proxy logs for the two custom headers used by the auto_post plugin.
Monitor MaxSite CMS webroot directories for file creation events involving server-executable content types.
Correlate authenticated admin sessions with file write activity outside the expected media upload paths.

Monitoring Recommendations

Enable full HTTP header logging on the web server hosting MaxSite CMS to capture custom X-Requested-* headers.
Alert on any process spawned by the web server user that originates from newly created files in the uploads directory.
Track admin plugin usage frequency and flag anomalous request volume to the auto_post plugin endpoints.

How to Mitigate CVE-2025-12346

Immediate Actions Required

Restrict access to the MaxSite CMS admin interface using network-level controls or IP allowlisting until a vendor patch is available.
Block or filter HTTP requests containing the X-Requested-FileName and X-Requested-FileUpDir headers at the reverse proxy or web application firewall.
Audit MaxSite CMS upload directories for unexpected files and remove any unauthorized content.
Rotate credentials for all MaxSite CMS admin accounts and enforce strong authentication.

Patch Information

As of the last NVD update on 2026-06-17, no vendor patch has been published. The vendor did not respond to disclosure attempts. Administrators should track the VulDB advisory for updates and consider migrating to an actively maintained CMS if no fix is released.

Workarounds

Disable the auto_post plugin by removing or renaming the application/maxsite/admin/plugins/auto_post/ directory if the plugin is not required.
Configure the web server to deny execution of scripts within uploads directories using directory-level handler restrictions.
Deploy a web application firewall rule to drop requests to the vulnerable endpoint that include the custom upload headers.

bash

# Example nginx rule to block requests with the vulnerable headers
location ~ ^/application/maxsite/admin/plugins/auto_post/uploads-require-maxsite\.php$ {
    if ($http_x_requested_filename) { return 403; }
    if ($http_x_requested_fileupdir) { return 403; }
}

# Deny script execution in uploads directory
location ~ ^/uploads/.*\.(php|phtml|phar)$ {
    deny all;
}