Executive brief
MaxSite CMS is a content management system used to build websites and blogs. The admin file upload feature allows authenticated users to upload HTML files with malicious scripts to a publicly accessible directory. When visitors access these uploaded HTML files, the embedded scripts execute in their browsers, enabling attackers to steal session cookies, redirect users to phishing pages, or deface the site.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the admin_page upload handler. The file upload endpoint in application/maxsite/admin/plugins/admin_page/uploads-require-maxsite.php accepts a destination filename from the HTTP header X-Requested-Filename and file content directly from php://input with no validation of content. While an extension allowlist restricts uploads, HTML and HTM files are allowed by default. The referer check is trivial to bypass. An authenticated admin user can upload malicious HTML to the uploads/_pages/ directory, which is then served to all visitors and executes in their browsers. The research indicates that forged admin sessions are possible without credentials via a separate finding. In deployments where PHP execution is enabled in the uploads directory, attackers could achieve remote code execution by uploading PHP files if the allowlist is extended.
Affected products
- MaxSite CMS 0.94 through 109.6
Timeline
- 2026-09-09: disclosed
- 2026-09-08: advisory: Public GitHub advisory