CVE-2026-87927: MaxSite CMS Path Traversal Vulnerability

CVE-2026-87927 Overview

CVE-2026-87927 is a Local File Inclusion (LFI) vulnerability in MaxSite CMS through version 109.6. The flaw resides in the ajax and require-maxsite dispatchers, which accept base64-encoded parameters that resolve to handler file paths. Attackers can supply base64-encoded path traversal sequences to bypass validation checks and load arbitrary handler files. Unauthenticated remote attackers can invoke admin-gated handler actions without providing credentials, exposing privileged functionality. The vulnerability is tracked under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact
Unauthenticated attackers can execute privileged PHP handler files by supplying base64-encoded path traversal payloads, bypassing authentication on admin-only functionality in MaxSite CMS through version 109.6.

Affected Products

MaxSite CMS versions through 109.6
The application/views/ajax.php dispatcher
The application/views/require-maxsite.php dispatcher

Discovery Timeline

2026-09-09 - CVE-2026-87927 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87927

Vulnerability Analysis

MaxSite CMS exposes two front-controller dispatchers that route requests to internal PHP handler files. Both ajax.php and require-maxsite.php accept user-controlled input specifying which handler to execute. The dispatchers decode the input and attempt to validate the resulting path before including the target file with a PHP require or include statement.

The validation logic fails to canonicalize the decoded path before checking it against expected directories. Attackers exploit this gap by base64-encoding path traversal sequences such as ../ to escape the intended handler directory. The dispatcher decodes the payload, passes the traversal-laden path to the include statement, and executes any PHP file the web server user can read.

Because the dispatchers do not enforce authentication before resolving the target handler, attackers can invoke handler files that are otherwise gated behind the admin interface. This exposes privileged administrative actions to unauthenticated network callers.

Root Cause

The root cause is improper control of filename parameters used in PHP require/include statements [CWE-98]. Base64 decoding occurs before path validation, and the validation does not normalize traversal sequences. Authentication checks are also enforced inside individual handler files rather than at the dispatcher, so any handler reached via traversal executes without an authentication gate.

Attack Vector

An unauthenticated attacker crafts an HTTP request to the vulnerable dispatcher endpoint. The attacker base64-encodes a path containing ../ sequences pointing to a privileged handler file. The dispatcher decodes the value, bypasses path validation, and includes the target PHP file. Refer to the VulnCheck advisory and the public technical write-up for the affected code paths in ajax.php lines 17-42 and require-maxsite.php lines 13-29.

No verified proof-of-concept code is published in the enriched data. See the linked advisories for reproduction details.

Detection Methods for CVE-2026-87927

Indicators of Compromise

HTTP requests to ajax.php or require-maxsite.php containing long base64-encoded query or POST parameters
Base64 payloads that decode to strings containing ../ or absolute paths pointing outside the intended handler directory
Web server access logs showing unauthenticated invocations of admin-gated handler actions
PHP error log entries referencing include/require failures with unusual file paths

Detection Strategies

Decode base64 parameters submitted to MaxSite CMS dispatchers and alert when the plaintext contains path traversal sequences
Deploy a Web Application Firewall (WAF) rule to flag requests to ajax.php and require-maxsite.php with parameters exceeding expected length or entropy
Correlate access to privileged handler endpoints with the absence of a valid authenticated session cookie

Monitoring Recommendations

Enable verbose access logging on the web server hosting MaxSite CMS
Forward web and PHP application logs to a centralized analytics platform for retention and query
Baseline normal parameter values submitted to the dispatchers and alert on statistical outliers

How to Mitigate CVE-2026-87927

Immediate Actions Required

Restrict network access to MaxSite CMS administrative surfaces to trusted IP ranges until a vendor patch is available
Deploy WAF signatures that block base64-encoded path traversal payloads sent to ajax.php and require-maxsite.php
Audit web server and application logs for prior exploitation attempts referencing the vulnerable dispatchers

Patch Information

No vendor patch is referenced in the enriched CVE data. Monitor the MaxSite CMS repository and the VulnCheck advisory for a fixed release beyond version 109.6.

Workarounds

Block external access to application/views/ajax.php and application/views/require-maxsite.php at the web server layer if the endpoints are not required
Enforce authentication at the web server or reverse proxy for any request touching the vulnerable dispatchers
Apply PHP open_basedir restrictions to limit the file paths the CMS process can include or require

bash

# Example nginx configuration restricting dispatcher access to an internal network
location ~ ^/application/views/(ajax|require-maxsite)\.php$ {
    allow 10.0.0.0/8;
    deny all;
}