CVE-2026-70553 is a remote code execution vulnerability in MaxSite CMS 105.2. Attackers can submit specially crafted POST requests to the install endpoint after installation is complete, injecting malicious PHP code into the application/config/database.php file by manipulating the db_dbprefix value. This value breaks out of a PHP string literal and appends attacker-controlled PHP statements, which are executed on every subsequent request, resulting in persistent unauthenticated remote code execution as the web server user.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the server running MaxSite CMS 105.2. This leads to full compromise of the web server process, enabling actions such as data theft, server manipulation, or further network pivoting. The vulnerability is critical with a CVSS 4.0 score of 9.3, reflecting its ease of exploitation and high impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the install endpoint after installation and monitor for suspicious POST requests targeting this endpoint to reduce exposure.