CVE-2026-3395
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on MaxSite CMS installations through a code injection flaw in the MarkItUp Preview AJAX endpoint. Attackers can exploit this without authentication to gain control of affected systems. All MaxSite CMS users running versions up to 109.1 are affected.
💻 Affected Systems
- MaxSite CMS
📦 What is this software?
Maxsite Cms by Max 3000
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, steal data, install malware, or pivot to other systems.
Likely Case
Remote code execution leading to website defacement, data theft, or installation of backdoors for persistent access.
If Mitigated
Limited impact if proper network segmentation, WAF rules, and input validation are in place, though exploitation may still occur.
🎯 Exploit Status
The exploit has been published and can be launched remotely without authentication, making this easily weaponizable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 109.2
Vendor Advisory: https://github.com/maxsite/cms/commit/08937a3c5d672a242d68f53e9fccf8a748820ef3
Restart Required: No
Instructions:
1. Backup your MaxSite CMS installation and database. 2. Download version 109.2 from the official repository. 3. Replace the vulnerable file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php with the patched version. 4. Verify the patch by checking the file hash matches commit 08937a3c5d672a242d68f53e9fccf8a748820ef3.
🔧 Temporary Workarounds
Disable MarkItUp Preview AJAX Endpoint
linuxTemporarily disable the vulnerable endpoint by removing or renaming the preview-ajax.php file
mv /path/to/maxsite/application/maxsite/admin/plugins/editor_markitup/preview-ajax.php /path/to/maxsite/application/maxsite/admin/plugins/editor_markitup/preview-ajax.php.disabled
Implement WAF Rules
allAdd web application firewall rules to block requests to the vulnerable endpoint
🧯 If You Can't Patch
- Restrict network access to the MaxSite CMS admin interface using IP whitelisting
- Disable the MarkItUp editor plugin entirely and use alternative editor options
🔍 How to Verify
Check if Vulnerable:
Check if file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php exists and compare its content with the vulnerable versionCheck Version:
Check MaxSite CMS version in the admin panel or look for version information in configuration filesVerify Fix Applied:
Verify the file hash of preview-ajax.php matches the patched version: sha1sum should equal 08937a3c5d672a242d68f53e9fccf8a748820ef3📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /admin/plugins/editor_markitup/preview-ajax.php
- Suspicious eval() function calls in PHP error logs
- Unexpected process execution from web server user
Network Indicators:
- HTTP requests containing malicious code patterns targeting the preview endpoint
- Outbound connections from web server to suspicious IPs
SIEM Query:
source="web_server_logs" AND uri="/admin/plugins/editor_markitup/preview-ajax.php" AND (method="POST" OR method="GET") AND (payload CONTAINS "eval" OR payload CONTAINS "system" OR payload CONTAINS "exec")