CVE-2026-87930

MaxSite CMS through version 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject arbitrary PHP objects (CWE-502, deserialization of untrusted data). Because the application uses a hardcoded encryption key, an attacker can forge session cookies that pass integrity checks, and the injected objects then trigger magic methods. Depending on the gadget classes present in a given installation, this can corrupt application state or escalate to arbitrary code execution; the flaw is scored critical at 9.2 (CVSS 4.0) with high confidentiality, integrity, and availability impact. Any internet-facing MaxSite CMS deployment running version 109.6 or older is affected, with no privileges or user interaction required. There is currently no public proof-of-concept, the issue is not in the CISA KEV catalog, and no confirmed in-the-wild exploitation is known.

What to do: Upgrade MaxSite CMS to a release newer than 109.6 as soon as a fixed version is available. As an interim mitigation, replace the hardcoded default encryption key with a unique, strong secret in the CMS session/cookie configuration so attackers cannot forge valid ci_session cookies. Review access logs for unusual or tampered ci_session cookie values and restrict untrusted access to affected sites where possible.