Description

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/_pages/ directory, which executes in visitors' browsers when the file is accessed, enabling persistent stored cross-site scripting attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-09T17:17:53.697Z",
  "pubdate": "2026-09-09T17:17:53.697Z",
  "executiveSummary": "MaxSite CMS, spanning versions 0.94 through 109.6, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability originating from the admin_page upload handler. The vulnerability permits authenticated users to upload arbitrary HTML files containing malicious JavaScript payloads to the server's public file directory.\nThe vulnerability represents a critical security oversight in file validation mechanisms, allowing an attacker to achieve persistent code execution within the context of visitors' web browsers. By successfully uploading a crafted HTML file to the uploads/_pages/ directory, an attacker can ensure that malicious scripts are rendered whenever a victim accesses the specific file path.\nThe impact is significant, as it enables session hijacking, unauthorized redirection, defacement, or the theft of sensitive session tokens from authenticated administrators or end-users. The exploitation requires active authentication within the application, but effectively bypasses standard administrative controls regarding file type verification. Successful exploitation undermines the integrity of the web application's host domain, necessitating immediate remediation to prevent the weaponization of the file upload feature for malicious content delivery.",
  "technicalDetails": "The vulnerability resides within the admin_page upload handler component of MaxSite CMS, which fails to adequately sanitize or restrict file uploads based on MIME types or content inspection. Although the system is intended to manage content, the lack of a strict allow-list for file extensions enables the upload of executable web content, specifically HTML files containing arbitrary JavaScript.\nThe attack flow commences with the attacker authenticating into the MaxSite CMS environment. Upon reaching the administrative interface responsible for content management, the attacker leverages the admin_page upload handler to transmit a malicious HTML file. Because the application does not validate the internal structure or the extension of the uploaded file against a secure policy, the server persists the file in the uploads/_pages/ directory. This directory is publicly accessible, meaning any user or automated crawler requesting the file URL will cause the server to serve the HTML content directly to the browser.\nOnce the file is uploaded, the attacker distributes the link to the malicious file. When a victim or administrator navigates to the file path, the browser interprets the HTML and executes the embedded script within the context of the MaxSite CMS origin. This breach of the Same-Origin Policy (SOP) allows the malicious script to access cookies, local storage, and session identifiers associated with the domain, potentially leading to full account takeover or unauthorized actions performed on behalf of the victim.\nThe root cause is an insufficient validation of file types in the administrative upload logic, combined with the storage of these files in a directory that facilitates direct browser execution. The affected versions are 0.94 through 109.6. Because the execution occurs in the client's browser upon requesting the file, this constitutes a Stored XSS attack that is both persistent and highly effective for targeting administrative sessions.\nPost-exploitation impact includes the potential for persistent malware distribution, credential theft, and the modification of site content if the victim possesses higher privileges. The vulnerability does not require complex infrastructure, only the ability to authenticate as a user capable of accessing the page upload feature. Without rigorous server-side filtering and strict enforcement of content-type headers, the integrity of the application environment remains compromised."
}