CVE-2026-70554: MaxSite CMS RCE Vulnerability

CVE-2026-70554 Overview

CVE-2026-70554 is an unauthenticated PHP object injection vulnerability in MaxSite CMS. The application passes attacker-controlled serialized data from the maxsite_comuser cookie directly to unserialize() without validation or class allowlisting. Attackers can deliver a crafted serialized PHP object in a single HTTP request to trigger magic methods during object graph reconstruction. This enables property-oriented programming (POP) attacks and remote code execution when suitable gadget chains are available, including those exposed by the SoapClient or Imagick extensions. The weakness maps to CWE-502: Deserialization of Untrusted Data and requires no authentication, user interaction, or elevated privileges to exploit.

Critical Impact
Unauthenticated remote attackers can achieve arbitrary code execution on MaxSite CMS installations by sending a single HTTP request containing a malicious cookie value.

Affected Products

MaxSite CMS (see GitHub CMS Repository)
MaxSite CMS distributions referenced on the Max-3000 project page
Deployments reachable over HTTP that accept the maxsite_comuser cookie

Discovery Timeline

2026-08-04 - CVE-2026-70554 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70554

Vulnerability Analysis

MaxSite CMS reads the maxsite_comuser cookie from incoming HTTP requests and deserializes its contents using PHP's unserialize() function. The code path lacks input validation, cryptographic integrity checks, and any allowed_classes restriction. As a result, an attacker who controls the cookie value controls the type and properties of the resulting PHP object graph.

During reconstruction, PHP automatically invokes magic methods such as __wakeup(), __destruct(), and __toString() on the deserialized objects. When application or extension classes define side-effecting logic inside these methods, the attacker can chain them into a property-oriented programming gadget to reach dangerous sinks such as file writes, dynamic includes, or command execution. Public gadget chains for SoapClient and Imagick are documented and can be leveraged where those extensions are present.

Root Cause

The root cause is unsafe deserialization of untrusted input. The application treats the maxsite_comuser cookie as a trusted serialized session artifact and passes it to unserialize() without validating the payload structure, verifying an integrity signature, or restricting instantiable classes via the allowed_classes option introduced in PHP 7.

Attack Vector

Exploitation is remote and unauthenticated. An attacker sends a single HTTP request to any MaxSite CMS endpoint that processes the maxsite_comuser cookie. The cookie value carries a serialized PHP object graph crafted to invoke a gadget chain during deserialization. Depending on available classes in the runtime, outcomes range from arbitrary file operations to full remote code execution. Additional detail is available in the VulnCheck Advisory on Maxsite CMS.

No verified public exploit code is referenced in the CVE data. The vulnerability mechanism follows the standard PHP object injection pattern: attacker-controlled serialized data reaches unserialize(), magic methods fire, and gadget chains reach sensitive sinks. See the linked advisory for technical details.

Detection Methods for CVE-2026-70554

Indicators of Compromise

HTTP requests containing a maxsite_comuser cookie whose value begins with PHP serialization markers such as O:, a:, s:, or C: rather than a plain identifier.
Cookie payloads referencing sensitive class names such as SoapClient, Imagick, GuzzleHttp\Psr7\FnStream, or other known gadget classes.
Unexpected outbound HTTP or SMB connections from the web server process immediately after a request carrying the maxsite_comuser cookie.
New or modified PHP files under the MaxSite CMS webroot without a corresponding administrative action.

Detection Strategies

Inspect web access logs and WAF telemetry for Cookie: headers containing maxsite_comuser= values that match serialized PHP object patterns.
Alert on php-fpm, apache2, or nginx worker processes spawning shells (sh, bash, /bin/dash) or interpreters (python, perl) that are not part of normal application behavior.
Correlate deserialization-shaped cookie values with subsequent process-execution or file-write events on the same host within a short time window.

Monitoring Recommendations

Enable verbose logging on the reverse proxy or WAF to capture full Cookie header contents for MaxSite CMS hosts.
Monitor filesystem changes under the CMS document root and PHP session directories for unexpected writes.
Track egress network connections from web server hosts to detect SSRF and reverse-shell activity typical of successful PHP object injection.

How to Mitigate CVE-2026-70554

Immediate Actions Required

Apply the vendor patch published in the MaxSite CMS GitHub repository as soon as it is available for your deployment.
Restrict access to affected MaxSite CMS instances at the network edge until patching is complete, ideally allowlisting known administrative sources.
Invalidate existing maxsite_comuser cookies and rotate any credentials or secrets stored on affected servers, treating unpatched hosts as potentially compromised.
Review web server logs for prior requests carrying serialized payloads in the maxsite_comuser cookie to identify pre-patch exploitation attempts.

Patch Information

Refer to the VulnCheck Advisory on Maxsite CMS and the upstream MaxSite CMS GitHub repository for the fixed release. The remediation replaces the direct call to unserialize() on the cookie value with a safe parser or enforces allowed_classes => false on any residual deserialization path.

Workarounds

Deploy a WAF rule that blocks requests where the maxsite_comuser cookie value matches PHP serialization signatures such as ^[OaCs]:\d+:.
Configure the web server to strip or normalize the maxsite_comuser cookie for unauthenticated requests until the patch is deployed.
Disable the SoapClient and Imagick extensions on the PHP runtime where they are not required, reducing available gadget chains.
Enforce cookie integrity by fronting the application with a reverse proxy that signs and verifies session cookies before they reach PHP.

bash

# Example ModSecurity rule to block serialized PHP objects in the maxsite_comuser cookie
SecRule REQUEST_COOKIES:maxsite_comuser "@rx ^[OaCs]:[0-9]+:" \
  "id:1026070554,phase:1,deny,status:403,log,\
   msg:'CVE-2026-70554: PHP object injection attempt in maxsite_comuser cookie'"