Description
MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execute admin-gated handler actions without authentication to access sensitive functionality.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
MaxSite MaxSite CMS
Default version status: unaffected
0.78 to ≤ 109.6affected
pkg:github/maxsite/cmsReferences
- https://github.com/maxsite/cms ↗
- https://github.com/EviL0rd/maxsite-cve1/blob/main/2026.09.08-maxsite-cms-ajax-lfi-path-traversal.md ↗
- https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/application/views/ajax.php#L17-L42 ↗
- https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/application/views/require-maxsite.php#L13-L29 ↗
- https://www.vulncheck.com/advisories/maxsite-cms-through-109.6-local-file-inclusion-via-ajax-dispatcher ↗