CVE-2026-87928 in MaxSite
Summary
by MITRE • 09/09/2026
MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/_pages/ directory, which executes in visitors' browsers when the file is accessed, enabling persistent stored cross-site scripting attacks.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The identified vulnerability resides within MaxSite CMS versions ranging from 0.94 through 109.6 and specifically targets the admin_page upload handler functionality. This component is designed to facilitate the management of page content by administrators but contains a critical flaw that permits the uploading of HTML files without adequate sanitization or validation of their contents. The core technical issue stems from insufficient input validation mechanisms within the file handling routine, which fails to distinguish between benign document uploads and potentially malicious script injections. By allowing any authenticated user to upload raw HTML files directly into the server's directory structure, particularly under the uploads/_pages/ path, the system inadvertently creates a vector for persistent cross-site scripting attacks. This flaw represents a significant deviation from secure coding practices regarding file type restrictions and content validation, as it assumes that all uploaded content is safe or properly escaped before being served to end-users.
From an operational perspective, this vulnerability enables stored cross-site scripting where malicious scripts are permanently embedded within the application's data store rather than existing transiently in a URL parameter. When an attacker uploads an HTML file containing crafted JavaScript code, that script becomes part of the site's content repository. Subsequently, when any visitor accesses the page associated with that uploaded file through their web browser, the malicious script executes automatically within the context of the victim's session. This persistence distinguishes it from reflected XSS attacks and significantly amplifies its potential impact. The attacker does not need to trick users into clicking a specially crafted link; instead, the payload is served directly by the application itself whenever the compromised page is viewed. This mechanism allows for long-term exploitation until the malicious file is manually identified and removed by an administrator, who may remain unaware of the compromise if detection mechanisms are not in place.
The security implications of this vulnerability extend beyond simple script execution to include severe risks such as session hijacking, credential theft, defacement, and redirection to phishing sites. Since the scripts execute with the privileges of the user viewing the page, attackers can potentially steal administrative cookies or other sensitive data stored by web applications in local storage if those elements are accessible from the context where the script runs. Furthermore, because the vulnerability affects any logged-in user, it lowers the barrier for entry compared to vulnerabilities requiring unauthenticated access or high-privilege accounts alone. However, the requirement for authentication means that threat actors typically need prior compromise of a low-level account or social engineering success to initiate this attack chain. The ability to upload arbitrary HTML files also bypasses traditional content filtering strategies that rely on blocking specific file extensions like .php or .exe, as HTML is often permitted for legitimate website building purposes.
In terms of industry classification standards, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. More specifically, it falls under the subcategory of Stored XSS where malicious scripts are permanently stored within target servers. Additionally, from a tactical perspective related to adversary behavior models such as MITRE ATT&CK, this technique corresponds to T1059 Command and Control via Application Layer Protocol or more broadly to techniques involving web application exploitation for initial access and persistence. The use of uploaded files to host malicious payloads is also consistent with tactics aimed at establishing long-term footholds within compromised environments without triggering immediate alarms due to the legitimate appearance of the hosting mechanism.
Mitigation strategies must focus on implementing strict allow-listing for file uploads rather than relying solely on extension blocking or client-side validation which can be easily bypassed. Developers should enforce MIME type verification that checks both the file header and server-side analysis to ensure only expected content types are processed. Furthermore, any HTML content intended for display in user-facing contexts must undergo rigorous sanitization using established libraries such as OWASP Java Encoder Project guidelines or equivalent frameworks that strip out script tags, event handlers, and other executable elements while preserving safe formatting attributes if necessary. Implementing Content Security Policy headers can also mitigate the impact by restricting where scripts are allowed to load from, thereby preventing execution of inline scripts even if they manage to be stored in the database. Regular security audits focusing on file upload handlers and continuous monitoring for anomalous file additions in public-facing directories will further reduce exposure risk.