CVE-2026-87928: MaxSite CMS Stored XSS Vulnerability

CVE-2026-87928 Overview

CVE-2026-87928 is a stored cross-site scripting (XSS) vulnerability in MaxSite CMS versions 0.94 through 109.6. The flaw resides in the admin_page upload handler, which permits any authenticated user to upload HTML files without content sanitization. Attackers place HTML files containing malicious JavaScript into the uploads/_pages/ directory. When a visitor accesses the uploaded file, the browser executes the attacker-controlled script in the site's origin. This enables session theft, credential harvesting, and further compromise of administrative accounts. The vulnerability is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Any authenticated MaxSite CMS user can plant persistent JavaScript payloads that execute in the browsers of site visitors and administrators, enabling session hijacking and account takeover.

Affected Products

MaxSite CMS version 0.94 (lower bound)
MaxSite CMS versions 0.95 through 109.5 (intermediate releases)
MaxSite CMS version 109.6 (upper bound)

Discovery Timeline

2026-09-09 - CVE-2026-87928 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87928

Vulnerability Analysis

The vulnerability exists in the MaxSite CMS admin_page plugin, specifically in the uploads-require-maxsite.php handler. The handler accepts file uploads from any authenticated user without validating the file type, extension, or MIME content. Uploaded files land in the web-accessible uploads/_pages/ directory and retain their original extension. An attacker with low-privilege credentials uploads an HTML document containing <script> tags or event handlers. When a victim requests the file URL, the browser parses the response as HTML and executes the embedded JavaScript under the site's origin. Because the payload persists on disk, every visitor to the URL triggers the script, producing a stored XSS condition with cross-site scope.

Root Cause

The root cause is missing server-side validation in the upload handler. The plugin does not enforce an allowlist of safe file types, does not rewrite dangerous extensions, and does not set a restrictive Content-Type or Content-Disposition header when serving user-supplied files. The design assumes authenticated users are trusted, but MaxSite CMS allows low-privilege accounts to reach the upload endpoint.

Attack Vector

An attacker authenticates to the CMS with any valid user account. The attacker then submits an HTML file containing JavaScript through the admin_page upload interface. The file is written to uploads/_pages/ and becomes accessible over HTTP. The attacker distributes the URL through phishing, forum posts, or direct links. Each visit executes the payload in the site's origin, granting access to cookies, session tokens, and DOM content. Full technical details are documented in the GitHub CVE Report and the VulnCheck Security Advisory.

No verified proof-of-concept code is published; refer to the GitHub Plugin Code Review for the vulnerable handler source.

Detection Methods for CVE-2026-87928

Indicators of Compromise

Presence of .html, .htm, .svg, or .xhtml files inside the uploads/_pages/ directory that were not created by administrators.
Web server access log entries showing GET requests to /uploads/_pages/*.html from external IP addresses.
Outbound HTTP requests from visitor browsers to attacker-controlled domains referenced by uploaded pages.
New or unexpected files in uploads/_pages/ with modification timestamps correlating to low-privilege user sessions.

Detection Strategies

Perform static scanning of the uploads/_pages/ directory for files containing <script>, onerror=, onload=, or javascript: strings.
Correlate CMS audit logs of upload events with the account role that performed the upload; flag uploads by non-administrator accounts.
Monitor HTTP response Content-Type headers for text/html served from user-upload directories.

Monitoring Recommendations

Enable file integrity monitoring on the uploads/_pages/ directory and alert on any new file creation.
Ingest web server and CMS application logs into a centralized analytics platform and alert on uploads with executable content types.
Track anomalous authentication events from low-privilege CMS accounts that precede file uploads.

How to Mitigate CVE-2026-87928

Immediate Actions Required

Audit all files present in uploads/_pages/ and remove any HTML, SVG, or script-bearing content that was not placed by an authorized administrator.
Restrict CMS account creation and revoke upload capability from non-administrator roles until a patch is applied.
Rotate session cookies and administrative credentials if evidence of exploitation is found.
Block direct browser access to the uploads/_pages/ directory at the web server or reverse-proxy layer.

Patch Information

As of the NVD publication date of 2026-09-09, no fixed release is referenced in the advisory data. Monitor the MaxSite CMS GitHub repository and the VulnCheck Security Advisory for an official update covering versions beyond 109.6.

Workarounds

Configure the web server to serve files from uploads/_pages/ with Content-Type: text/plain and Content-Disposition: attachment headers, preventing inline HTML rendering.
Add a web application firewall rule that blocks uploads to admin_page when the request body contains HTML tags or JavaScript event handlers.
Deploy a strict Content-Security-Policy header that disallows inline scripts and restricts script sources to trusted origins.
Limit access to the CMS administrative interface by source IP address or VPN until a fixed version is released.

bash

# Nginx configuration to neutralize HTML files in the uploads directory
location ^~ /uploads/_pages/ {
    types { } default_type text/plain;
    add_header Content-Disposition "attachment";
    add_header X-Content-Type-Options "nosniff";
    add_header Content-Security-Policy "default-src 'none'; script-src 'none'";
}