CVE-2026-87928 Details

A cross-site scripting vulnerability has been identified in MaxSite CMS versions 0.94 through 109.6. The issue arises in the admin_page upload handler, where any logged-in user can upload HTML files. These files can contain malicious scripts that, when accessed, execute in the browsers of visitors, leading to persistent stored cross-site scripting attacks. The vulnerability allows for arbitrary file uploads into the uploads/_pages/ directory, where the uploaded HTML is served to users, executing the embedded scripts.

To address this vulnerability, MaxSite CMS should implement stricter upload controls by allowing only multipart file uploads through 'file' fields, and ensuring that files are saved with server-generated names. HTML and HTM files should be removed from the list of permitted extensions, and uploaded content should be validated against its actual file type before being accepted.