Local File Inclusion in MaxSite CMS via Ajax Dispatchers

MaxSite CMS versions up to and including 109.6 are affected by a critical local file inclusion (LFI) vulnerability residing within the system's ajax and require-maxsite dispatchers. This flaw allows unauthenticated, remote attackers to bypass existing path validation mechanisms by supplying base64-encoded path traversal sequences. By successfully manipulating these request parameters, an adversary can force the application to load and execute internal, privileged handler files. Because these handlers often contain administrative functionality, successful exploitation grants the attacker unauthorized access to sensitive application features or administrative actions that should remain gated behind proper authentication. Defenders should prioritize patching, as this vulnerability provides a direct pathway for unauthenticated remote code execution or privilege escalation depending on the target handler logic.

Impact

Successful exploitation of CVE-2026-87927 allows unauthenticated attackers to bypass security boundaries and execute privileged administrative functions within the MaxSite CMS environment. This can lead to full administrative takeover, unauthorized access to sensitive data, and potential remote code execution by leveraging internal handler scripts.

Recommendation

• Upgrade MaxSite CMS to a version beyond 109.6 immediately as soon as a security patch is provided by the vendor.
• Implement strict input validation on all ajax and require-maxsite endpoints to detect and reject base64-encoded strings or character sequences indicative of path traversal (e.g., ../, ..).
• Deploy WAF rules to identify and block incoming HTTP requests containing base64-encoded strings in parameters targeting the /ajax/ or /require-maxsite/ URI paths.