MaxSite CMS <=109.1 - Remote Code Execution
CVE-2026-3395
Verified
Description
MaxSite CMS through 109.1 allows unauthenticated remote attackers to execute arbitrary code via the MarkItUp editor preview AJAX endpoint, preview-ajax.php. The endpoint insufficiently authenticates the request, failing to ensure the user is logged in, and processes the attacker's input via unsafe usage of PHP eval() on user-supplied [php]...[/php] shortcodes. By providing a POST request to the vulnerable /ajax/ endpoint with crafted input, attackers may achieve remote code execution. The issue is addressed in version 109.2 by implementing proper authentication controls.
Severity
High
CVSS Score
7.3
Exploit Probability
2%
Affected Product
maxsite_cms
Published Date
August 13, 2026
Template Author
ritikchaddha
CVE-2026-3395.yaml
7.3Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVE ID:
cve-2026-3395
CWE ID:
cwe-94
References
https://github.com/mbanyamer/CVE-2026-3395-MaxSite-CMS-Unauthenticated-RCEhttps://github.com/rootdirective-sec/CVE-2026-3395-Labhttps://github.com/maxsite/cms/commit/08937a3c5d672a242d68f53e9fccf8a748820ef3https://vuldb.com/?id.348281https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/large-scale-exploitation-campaign-targeting-website-content-management-systems-cmshttps://nvd.nist.gov/vuln/detail/CVE-2026-3395