CVE-2026-87930CWE-502insecure-deserialization

CVE-2026-87930

High · published September 9, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
48.3
In the wild
Unconfirmed
What it is

MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve code execution if gadget classes exist.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00606 · 48.3th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-09-09T21:17Z
References (7)
https://github.com/EviL0rd/maxsite-cve4/blob/main/2026.09.08-maxsite-cms-hardcoded-session-key-auth-bypass.md · [email protected]https://github.com/EviL0rd/maxsite-cve6/blob/main/2026.09.08-maxsite-cms-unsafe-unserialize-object-injection.md · [email protected]https://github.com/maxsite/cms · [email protected]https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/application/config/config.php#L230-L254 · [email protected]https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/system/libraries/Session.php#L670-L680 · [email protected]https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/system/libraries/Session.php#L740-L742 · [email protected]https://www.vulncheck.com/advisories/maxsite-cms-through-109.6-php-object-injection-via-ci-session · [email protected]
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 16:45Z
    MaxSite CMS through 109.6 PHP Object Injection via ci_session
    cvelistv5