C V E- 2 0 2 6- 8 7 9 3 0: M a x S i t e C M S R C E V u l n e r a b i l i t y

CVE-2026-87930 Overview

MaxSite CMS through version 109.6 contains a PHP object injection vulnerability in its session handling code. The application passes the ci_session cookie value directly to PHP's unserialize() function without restricting allowed classes. Attackers can forge valid session cookies by leveraging a hardcoded encryption key shipped with the framework. Successful exploitation triggers PHP magic methods during deserialization, enabling application state corruption and code execution when suitable gadget chains are available in the codebase. The vulnerability is classified under CWE-502: Deserialization of Untrusted Data.

Critical Impact
Unauthenticated remote attackers can inject arbitrary PHP objects into MaxSite CMS sessions, corrupting application state and achieving code execution when gadget classes are reachable.

Affected Products

MaxSite CMS versions up to and including 109.6
Deployments using the default hardcoded session encryption key
MaxSite CMS installations exposing the ci_session cookie handler

Discovery Timeline

2026-09-09 - CVE-2026-87930 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87930

Vulnerability Analysis

The defect combines two weaknesses that reinforce each other. First, MaxSite CMS ships with a hardcoded encryption_key value in application/config/config.php, allowing any attacker to reproduce the HMAC and encryption operations that validate session cookies. Second, the session library in system/libraries/Session.php calls unserialize() on the decrypted cookie payload without passing an allowed_classes option.

Because both weaknesses are present in default installations, an unauthenticated network attacker can craft a ci_session cookie that decrypts and passes integrity checks, then deserializes into arbitrary PHP objects. This enables invocation of magic methods such as __wakeup, __destruct, and __toString on attacker-chosen classes. Impact scales with the gadget classes available in the deployed MaxSite CMS instance and any third-party plugins loaded at request time.

Root Cause

Two defects combine to produce the vulnerability. A static encryption_key embedded in the shipped configuration removes the confidentiality and authenticity guarantees that session cookie protection depends on. The Session::_unserialize() path then invokes unserialize() on attacker-controlled bytes with no class allowlist, violating secure deserialization guidance for CWE-502.

Attack Vector

An attacker sends an HTTP request to any endpoint that reads session state, presenting a forged ci_session cookie. The cookie is encrypted and MAC-signed using the publicly known hardcoded key. The server decrypts the payload, verifies the MAC, and calls unserialize(), instantiating attacker-supplied objects. No authentication, no user interaction, and no prior session is required. Refer to the VulnCheck MaxSite CMS advisory and the GitHub object injection advisory for a full technical walkthrough.

Detection Methods for CVE-2026-87930

Indicators of Compromise

Unusually long or high-entropy ci_session cookie values in web server access logs from unauthenticated clients
Serialized PHP object markers such as O: or a: in decoded session payloads within application logs
Unexpected PHP errors referencing __wakeup, __destruct, or unserialize() in MaxSite CMS runtime logs
Outbound network connections or process spawns originating from the PHP-FPM or web server worker running MaxSite CMS

Detection Strategies

Inspect web request telemetry for ci_session cookies that fail to decode into the expected associative array shape after decryption
Alert on any PHP execution of unserialize() on cookie-sourced data using runtime application self-protection or WAF payload inspection
Correlate MaxSite CMS access logs with new file writes under application/ or plugins/ directories to catch post-exploitation webshells

Monitoring Recommendations

Enable verbose PHP error logging and forward MaxSite CMS logs to a centralized analytics platform for retention and search
Monitor for child processes of the web server such as sh, bash, python, or curl, which indicate post-deserialization command execution
Track file integrity across the MaxSite CMS document root to detect tampering of PHP files following suspicious cookie activity

How to Mitigate CVE-2026-87930

Immediate Actions Required

Rotate the encryption_key in application/config/config.php to a cryptographically random 32-byte value unique to each deployment
Invalidate all existing ci_session cookies by clearing server-side session storage and forcing users to re-authenticate
Restrict inbound access to MaxSite CMS administrative endpoints from untrusted networks until a vendor patch is verified
Audit installed plugins and themes for classes exposing dangerous magic methods that could form deserialization gadget chains

Patch Information

No official vendor patch is referenced in the NVD entry at publication. Track the MaxSite CMS repository for upstream fixes and consult the referenced GitHub auth bypass advisory and object injection advisory for temporary code-level guidance.

Workarounds

Patch the session library to call unserialize($data, ['allowed_classes' => false]) so that only primitive types are decoded from cookies
Deploy a web application firewall rule blocking ci_session cookie values that contain the substrings O: or serialized object markers
Replace cookie-based session storage with server-side session handling backed by a database or Redis store, keyed by a random opaque identifier
Enforce strict Set-Cookie attributes including HttpOnly, Secure, and SameSite=Strict to limit cookie theft avenues

bash

# Configuration example: rotate the hardcoded key and harden session settings
# application/config/config.php
$config['encryption_key'] = bin2hex(random_bytes(32));
$config['sess_driver']    = 'database';
$config['sess_cookie_name'] = 'ci_session';
$config['sess_expiration']  = 7200;
$config['sess_match_ip']    = TRUE;
$config['sess_regenerate_destroy'] = TRUE;