Quick answers
- Is CVE-2026-70553 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-70553 being exploited in the wild.
- How severe is CVE-2026-70553?
- Critical severity, with a CVSS score of 9.8, published 4 August 2026.
- Which products and versions are affected?
- MaxSite CMS 109.5 and earlier.
- Is there a fix for CVE-2026-70553?
- A patch was published on 2026-03-16: MaxSite CMS 109.6 released as security update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-70553 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-70553?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a PHP code injection flaw in the install endpoint (install/index.php or similar) that remains accessible after initial installation. An unauthenticated attacker can submit a crafted POST request with a malicious db_dbprefix parameter containing a single quote to break out of a PHP string literal in the application/config/database.php configuration file. By injecting properly-formatted PHP code, the attacker appends arbitrary statements that are parsed and executed by the web server on every subsequent application request. The attack requires network access to the install endpoint but no authentication or user interaction. The injected code executes with the privileges of the web server process, enabling persistent remote code execution.
Affected products
- MaxSite CMS 109.5 and earlier
Timeline
- 2026-08-04: disclosed
- 2026-03-16: patched: MaxSite CMS 109.6 released as security update