CVE-2026-70554 MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie
Unauthenticated attackers can achieve remote code execution in MaxSite CMS by sending malicious serialized data in the maxsite_comuser cookie.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-70554?
CVE-2026-70554 is a critical unsafe deserialization vulnerability in MaxSite CMS, published on 4 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowlisting. Attackers can craft a malicious serialized PHP object payload delivered in a single HTTP request to trigger magic methods during object graph reconstruction, enabling property-oriented programming attacks or remote code execution via available gadget chains such as those targeting SoapClient or Imagick extensions.
Weakness: CWE-502
Which versions are affected by CVE-2026-70554?
How do I fix CVE-2026-70554?
No fix has been published for CVE-2026-70554 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-70554 being exploited?
There is no known exploitation of CVE-2026-70554 in the wild and no public exploit code.
Sources
Also known as GHSA-jm66-348j-qvv2.