High severity · published Sep 9, 2026
CVE-2026-87930
MaxSite CMS through 109.6 PHP Object Injection via ci_session
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve code execution if gadget classes exist.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
MaxSite CMS · MaxSite
0.78 through 109.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-87930
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-87930
github.com
https://github.com/EviL0rd/maxsite-cve4/blob/main/2026.09.08-maxsite-cms-hardcoded-session-key-auth-bypass.md
github.com
https://github.com/EviL0rd/maxsite-cve6/blob/main/2026.09.08-maxsite-cms-unsafe-unserialize-object-injection.md
github.com
https://github.com/maxsite/cms
github.com
https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/application/config/config.php#L230-L254
github.com
https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/system/libraries/Session.php#L670-L680
github.com
https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/system/libraries/Session.php#L740-L742
More from MaxSite CMS
9.8
CVE-2026-87929
MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key
9.8
CVE-2026-70554
MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie
9.8
CVE-2026-70553
MaxSite CMS Unauthenticated RCE via Install Endpoint
9.8
CVE-2026-70552
MaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.php
8.2
CVE-2026-87927
MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher