CVE-2026-87927

MaxSite CMS versions through 109.6 contain a local file inclusion flaw (CWE-98) in the ajax and require-maxsite dispatchers. An unauthenticated remote attacker can supply base64-encoded path traversal sequences that bypass the dispatchers' path validation checks, causing the application to include and execute handler files that are otherwise gated behind administrator privileges. Successful exploitation lets the attacker trigger privileged handler actions without any credentials, with the CVSS 4.0 vector indicating a high integrity impact alongside a low confidentiality impact. Any deployment running MaxSite CMS 109.6 or earlier is affected. There is currently no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Upgrade MaxSite CMS to the latest release as soon as a patched version beyond 109.6 is published. As interim mitigation, restrict or monitor access to the ajax and require-maxsite dispatcher endpoints and block requests containing base64-encoded path traversal payloads via WAF rules. Check web server logs for unauthenticated requests to those dispatchers containing encoded traversal sequences, which may indicate exploitation attempts.