CVE-2026-37700: MaxSite CMS v.109.2 XSS Vulnerability

CVE-2026-37700 Overview

CVE-2026-37700 is a Cross-Site Scripting (XSS) vulnerability in MaxSite CMS version 109.2. The flaw exists in the backend page file upload endpoint used by admin_page. A remote attacker can leverage this endpoint to inject malicious script content that executes in the context of an authenticated administrator's browser session. Successful exploitation allows the attacker to obtain sensitive information from the administrative interface.

Critical Impact
Authenticated administrators visiting attacker-influenced backend pages can have session data, credentials, and CMS content exposed through script execution in the admin context.

Affected Products

MaxSite CMS version 109.2

Discovery Timeline

2026-06-03 - CVE-2026-37700 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-37700

Vulnerability Analysis

The vulnerability resides in the MaxSite CMS backend page file upload endpoint used by the admin_page component. The endpoint accepts file uploads without sufficient sanitization or output encoding of user-controlled content. When the uploaded content is rendered in the administrative interface, embedded script payloads execute in the browser of any administrator viewing the affected page.

The XSS condition allows attackers to obtain sensitive information accessible to the administrator session. This includes session cookies, CSRF tokens, and content displayed within the CMS backend. Because the vulnerability is reachable through the admin upload workflow, exploitation requires that an authenticated user trigger the unsafe rendering path.

Root Cause

The root cause is improper neutralization of input during web page generation in the file upload handler of admin_page. The endpoint fails to validate or encode upload metadata or file contents before they are reflected to the administrative interface. This omission permits stored or reflected script injection through the upload mechanism.

Attack Vector

An attacker submits a crafted file or upload request to the backend upload endpoint exposed by admin_page. The malicious payload is stored or reflected by the CMS and executes when an administrator loads the affected backend view. The attacker then exfiltrates session tokens or other sensitive data accessible from the admin context. See the GitHub CVE Details for proof-of-concept details published by the reporter.

Detection Methods for CVE-2026-37700

Indicators of Compromise

Unexpected files uploaded through the MaxSite backend file upload endpoint containing HTML, JavaScript, or SVG payloads with <script> tags or event handlers such as onerror and onload.
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after visiting MaxSite admin pages.
New or modified pages in MaxSite CMS containing inline scripts not authored by site administrators.

Detection Strategies

Inspect web server access logs for POST requests to backend upload routes used by admin_page and correlate uploads with subsequent admin GET requests.
Apply web application firewall rules to flag upload payloads containing script tags, JavaScript URI schemes, or DOM event handlers.
Review MaxSite CMS database tables and filesystem upload directories for content containing executable HTML or JavaScript.

Monitoring Recommendations

Enable verbose logging on the MaxSite CMS administrative interface and forward logs to a centralized SIEM for analysis.
Monitor administrator sessions for anomalous activity such as new admin user creation, unexpected configuration changes, or session token reuse from unfamiliar IP addresses.
Alert on Content Security Policy violation reports from admin browser sessions interacting with MaxSite CMS.

How to Mitigate CVE-2026-37700

Immediate Actions Required

Restrict access to the MaxSite CMS administrative interface using network-level controls such as IP allowlisting or VPN-only access.
Audit existing uploads and CMS content for stored XSS payloads and remove any suspicious files immediately.
Force a password reset and session invalidation for all administrator accounts until the issue is remediated.

Patch Information

No vendor patch is referenced in the published CVE data at the time of publication. Monitor the MaxSite Home Page and the GitHub CVE Details for upstream fix announcements and apply updates as soon as they become available.

Workarounds

Disable the backend file upload feature in admin_page until a fix is released if the functionality is not essential.
Deploy a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins for the admin interface.
Place the MaxSite CMS administrative interface behind a web application firewall configured to block XSS payloads in upload requests.

bash

# Example nginx configuration restricting admin access by IP
location /admin_page/ {
    allow 10.0.0.0/8;
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'";
}