PHP Object Injection Vulnerability in MaxSite CMS by MaxSite
CVE-2026-87930

9.2CRITICAL

Key Information:

Vendor

Maxsite

Status
Maxsite Cms
Vendor
CVE Published:
9 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-87930?

MaxSite CMS, in versions up to 109.6, is vulnerable to a PHP object injection flaw due to the improper handling of the ci_session cookie. This vulnerability allows unauthorized attackers to manipulate session cookies leveraging a hardcoded encryption key, enabling them to exploit magic methods and alter the application state. If certain gadget classes are available, this can lead to code execution, posing a significant threat to the integrity and security of the application.

Affected Version(s)

MaxSite CMS 0.78 <= 109.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-87930 - Proof of Concept

References

https://github.com/maxsite/cms
product
https://github.com/EviL0rd/maxsite-cve6/blob/main/2026.09...
exploittechnical-description
https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25db...
technical-description

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

EVIL0RD
.