CVE-2025-12346 MaxSite CMS HTTP Header uploads-require-maxsite.php unrestricted upload

Medium 5.3 Published 28 Oct 2025 Updated 28 Oct 2025

Attackers can upload arbitrary files via manipulated HTTP headers in MaxSite CMS, potentially leading to remote code execution.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-12346?

CVE-2025-12346 is a medium-severity vulnerability in MaxSite CMS, published on 28 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability was detected in MaxSite CMS up to 109. This vulnerability affects unknown code of the file application/maxsite/admin/plugins/auto_post/uploads-require-maxsite.php of the component HTTP Header Handler. Performing manipulation of the argument X-Requested-FileName/X-Requested-FileUpDir results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Weakness: CWE-434, CWE-284

Which versions are affected by CVE-2025-12346?

It affects 1 product.

Products include Max-3000 Maxsite Cms.

How do I fix CVE-2025-12346?

No fix has been published for CVE-2025-12346 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-12346 being exploited?

There is no known exploitation of CVE-2025-12346 in the wild and no public exploit code.

Sources

Also known as GHSA-cfpx-6j59-hggc.