Description

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execute admin-gated handler actions without authentication to access sensitive functionality.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-09T17:17:53.520Z",
  "pubdate": "2026-09-09T17:17:53.520Z",
  "executiveSummary": "MaxSite CMS, in versions up to 109.6, is affected by a critical Local File Inclusion (LFI) vulnerability residing within the system's dispatcher mechanisms.\nThis vulnerability stems from improper validation of user-supplied input used in file inclusion operations, specifically within the 'ajax' and 'require-maxsite' dispatchers.\nThe flaw allows unauthenticated remote attackers to bypass security constraints by utilizing base64-encoded path traversal sequences to reach arbitrary file paths.\nSuccessful exploitation permits the execution of privileged handler files that are intended only for administrative access, effectively bypassing authentication and authorization checks.\nThe potential impact includes unauthorized access to sensitive administrative functionality, data exposure, and potentially full application compromise depending on the capabilities of the reachable handler files.\nGiven that this vulnerability requires no authentication and allows access to restricted system operations, it poses a severe security risk to installations of MaxSite CMS up to version 109.6.",
  "technicalDetails": "The vulnerability is situated within the request routing and dispatching logic of MaxSite CMS, specifically affecting the 'ajax' and 'require-maxsite' components responsible for handling requests.\nThe root cause is an insecure file inclusion implementation that fails to adequately sanitize or validate file paths supplied via user input before these paths are used to include or execute PHP files.\nThe application attempts to perform validation on the input, but this mechanism is flawed and can be circumvented through the use of base64 encoding to obfuscate path traversal sequences (e.g., '../').\nAn unauthenticated attacker can supply a crafted base64-encoded string representing a path traversal sequence to the vulnerable dispatchers. When the application decodes this input, it resolves the path to unintended locations within the filesystem.\nThis allows the attacker to force the inclusion and execution of arbitrary PHP files, specifically targeting privileged handler files meant to be accessible only by authorized administrative users.\nThe attack flow proceeds as follows: 1) The attacker identifies the entry points in the 'ajax' or 'require-maxsite' dispatchers. 2) The attacker crafts a base64-encoded string containing path traversal characters intended to bypass the application's sanitization layer. 3) The attacker transmits this payload in a request to the application. 4) The application's dispatcher decodes the payload, fails to validate the resulting path, and proceeds to include the file located at the traversal destination. 5) The server-side script executes the included file, granting the attacker the permissions and functionality associated with the targeted administrative handler, bypassing the application's native authentication framework.\nThis vulnerability is particularly dangerous because it facilitates privilege escalation by enabling access to sensitive functionality that the attacker would otherwise be blocked from accessing due to a lack of authenticated administrative privileges.\nThe vulnerability is present in MaxSite CMS versions up to and including 109.6 and requires no prior network-level restrictions or user interaction, making it highly exploitable over the network."
}