CVE-2026-87927 in MaxSite
Summary
by MITRE • 09/09/2026
MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execute admin-gated handler actions without authentication to access sensitive functionality.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The MaxSite CMS software, specifically through version 109.6, contains a critical local file inclusion vulnerability affecting its ajax and require-maxsite dispatchers. This flaw stems from insufficient input validation within the request handling mechanisms that process user-supplied data before including it in the application execution flow. The core technical issue involves the system's failure to properly sanitize or canonicalize path components provided by unauthenticated users, allowing for the injection of directory traversal sequences encoded in base64 format. By encoding these malicious paths, attackers can circumvent basic string-based security checks that might otherwise block standard dot-dot-slash patterns. This technique exploits the application's logic which decodes input before validation or fails to validate the decoded result against a strict allowlist of permitted files and directories.
This vulnerability enables unauthenticated remote code execution capabilities with significant operational impact on system integrity. Attackers can leverage this flaw to include arbitrary PHP handler files that are typically restricted by administrative authentication gates. By executing these privileged handlers, an attacker gains access to sensitive functionality without needing valid credentials. This effectively bypasses the intended access control mechanisms of the CMS, allowing for unauthorized data manipulation, configuration changes, or further exploitation steps such as web shell deployment. The ability to execute admin-gated actions means that critical administrative features become accessible to any internet-facing user with network connectivity to the vulnerable instance.
From a classification perspective, this vulnerability aligns with CWE-98 Improper Control of Filename for Include/Require Statements in PHP Programs and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. The attack vector is categorized under ATT&CK technique T1505.003 Server Side Request Forgery via Local File Inclusion, highlighting the mechanism by which external input influences internal file selection logic. The use of base64 encoding serves as a specific evasion tactic against naive signature-based detection systems that do not decode inputs prior to pattern matching.
Mitigation strategies should prioritize immediate patching to the latest stable version where this path validation flaw has been addressed. In environments where upgrading is not immediately feasible, administrators can implement web application firewall rules designed to detect and block base64-encoded directory traversal sequences in HTTP request parameters associated with ajax or require-maxsite endpoints. Additionally, enforcing strict input validation that canonicalizes paths before processing and restricting file inclusion operations to a predefined whitelist of safe files are essential defensive measures. Regular security audits focusing on dynamic include statements and ensuring that error reporting is disabled in production environments can further reduce the attack surface by limiting information leakage during exploitation attempts.