CVE-2026-70554

Summary

The flaw is a PHP object injection vulnerability in MaxSite CMS that allows unauthenticated attackers to execute arbitrary code by passing malicious serialized data through the maxsite_comuser cookie. This matters because it can lead to full system compromise without authentication.

Exploitability

Exploitation requires crafting a specific malicious payload and sending it via an HTTP request, which is moderately difficult but feasible given public exploit references.

Blast radius

If exploited, this could result in complete control over the affected server or network, with potential impact ranging from data theft to full system compromise.

Prioritized remediation

Update MaxSite CMS to a patched version immediately and validate all user inputs, especially those involving serialized data.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.