CVE-2025-12347: MaxSite CMS RCE Vulnerability

CVE-2025-12347 Overview

CVE-2025-12347 is an unrestricted file upload vulnerability in MaxSite CMS versions up to 109. The flaw resides in application/maxsite/admin/plugins/editor_files/save-file-ajax.php, where the file_path and content parameters are processed without proper validation. Authenticated remote attackers can manipulate these parameters to write arbitrary files to the server. The exploit has been publicly disclosed, and the vendor max-3000 did not respond to coordinated disclosure attempts. The vulnerability maps to [CWE-284] Improper Access Control and [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated attackers can write attacker-controlled content to arbitrary file paths on the server, enabling potential web shell deployment and remote code execution within the application context.

Affected Products

MaxSite CMS versions up to and including 109
Vendor: max-3000
Component: application/maxsite/admin/plugins/editor_files/save-file-ajax.php

Discovery Timeline

2025-10-28 - CVE-2025-12347 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-12347

Vulnerability Analysis

The vulnerability exists in the editor_files plugin shipped with MaxSite CMS. The save-file-ajax.php endpoint accepts user-supplied values for both the target file location (file_path) and the file body (content). The endpoint writes these values to disk without enforcing constraints on the destination path, file extension, or content type. As a result, an attacker with low-privilege authenticated access can write PHP files to web-accessible directories or overwrite existing application files. The issue is classified as a network-exploitable flaw requiring low privileges and no user interaction, with an EPSS score of 0.326% (24.207 percentile).

Root Cause

The root cause is a combination of two weaknesses. First, the save-file-ajax.php script trusts the file_path argument supplied by the client, permitting path manipulation outside the intended editor scope. Second, the script does not enforce an allowlist of file extensions or MIME types for the content argument, allowing executable PHP payloads to be saved. The endpoint lacks the access control checks expected for an administrative write operation, satisfying both [CWE-284] and [CWE-434].

Attack Vector

An attacker authenticates to the MaxSite CMS administrative interface using any account with editor-level privileges. The attacker then issues an HTTP POST request to save-file-ajax.php, setting file_path to a writable location under the webroot and content to a PHP web shell payload. After upload, the attacker requests the written file through the web server to execute the payload. No verified public proof-of-concept code is available in the referenced sources; see the HXLab Shared Resource and VulDB Entry #330137 for additional technical context.

Detection Methods for CVE-2025-12347

Indicators of Compromise

HTTP POST requests targeting application/maxsite/admin/plugins/editor_files/save-file-ajax.php with file_path values that include traversal sequences or non-editor directories.
Newly created .php, .phtml, or .phar files under the MaxSite CMS webroot whose timestamps do not align with legitimate administrative activity.
Outbound network connections originating from the PHP worker process to attacker-controlled hosts following file writes.

Detection Strategies

Inspect web server access logs for POST requests to save-file-ajax.php and correlate them with the authenticated session and source IP.
Deploy file integrity monitoring on the MaxSite CMS installation directory to flag any unexpected file creation or modification.
Apply web application firewall rules that block requests containing executable extensions or path traversal patterns in the file_path parameter.

Monitoring Recommendations

Alert on PHP process spawning shell interpreters or making outbound connections from directories under the MaxSite CMS install path.
Track administrative authentication events for the CMS and flag low-privilege accounts that subsequently invoke editor_files endpoints.
Review CMS audit logs daily for entries referencing the editor_files plugin during the exposure window.

How to Mitigate CVE-2025-12347

Immediate Actions Required

Restrict network access to the MaxSite CMS administrative interface using IP allowlists or VPN-only access until a patch is available.
Disable or remove the editor_files plugin if it is not required for operations.
Audit existing accounts and revoke editor-level privileges from any account that does not require write access to site content.
Scan the webroot for unauthorized .php files created since the deployment of MaxSite CMS version 109 or earlier.

Patch Information

As of the last NVD update on 2026-04-29, the vendor max-3000 has not issued a patch and did not respond to disclosure attempts. Operators should monitor the VulDB CTI Report #330137 for future vendor activity and consider migrating to an alternative CMS if no fix is published.

Workarounds

Remove or rename application/maxsite/admin/plugins/editor_files/save-file-ajax.php to disable the vulnerable endpoint.
Configure the web server to deny POST requests to the editor_files plugin path via a server-level rule.
Set filesystem permissions on the MaxSite CMS webroot so that the web server user cannot write to directories that serve PHP content.

bash

# Example nginx rule to block the vulnerable endpoint
location ~* /application/maxsite/admin/plugins/editor_files/save-file-ajax\.php$ {
    deny all;
    return 403;
}