Local File Inclusion Vulnerability in MaxSite CMS by MaxSite
CVE-2026-87927

8.8HIGH

Key Information:

Vendor

Maxsite

Status
Maxsite Cms
Vendor
CVE Published:
9 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-87927?

MaxSite CMS versions up to 109.6 are susceptible to a local file inclusion vulnerability that can be exploited via the ajax and require-maxsite dispatchers. This security flaw enables unauthenticated attackers to perform path traversal by providing base64-encoded sequences, allowing them to bypass critical path validation checks. Consequently, attackers can execute privileged handler files and gain unauthorized access to administrative functionalities, potentially compromising sensitive data and system integrity.

Affected Version(s)

MaxSite CMS 0.78 <= 109.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-87927 - Proof of Concept

References

https://github.com/maxsite/cms
product
https://github.com/EviL0rd/maxsite-cve1/blob/main/2026.09...
exploittechnical-description
https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25db...
technical-description

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

EVIL0RD
.