CVE-2026-87930 Details
Description
MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve code execution if gadget classes exist.
A vulnerability in MaxSite CMS versions through 109.6 allows for PHP object injection through the `ci_session` cookie, which is passed to `unserialize()` without class restrictions. This flaw enables unauthenticated attackers to forge valid session cookies using a hardcoded encryption key, injecting PHP objects that can trigger magic methods, corrupt application state, or execute code if suitable gadget classes are available.
To address this vulnerability, replace the hardcoded encryption key with a unique, randomly generated key during installation. Additionally, enable server-side sessions and revise the session validation process to ensure that only valid data is processed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 9, 2026CISA-ADP
Assessed Sep 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MaxSite CMS | >= 0.78, <= 109.6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 9, 2026 | CVE Modified | CISA-ADP |
| Sep 9, 2026 | New CVE Received | [email protected] |