CVE-2026-70554

Name of the Vulnerable Software and Affected Versions MaxSite CMS (affected versions not specified)

Description An issue exists where unauthenticated attackers can execute arbitrary code by providing malicious serialized data through the maxsite comuser cookie. The application passes this data directly to the unserialize() function without proper validation or class allowlisting. This allows for property-oriented programming attacks or remote code execution by triggering magic methods during object graph reconstruction, utilizing gadget chains such as those found in the SoapClient or Imagick extensions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.