CVE-2026-70553 is a remote code execution vulnerability in MaxSite CMS version 105.2. The flaw allows unauthenticated attackers to inject arbitrary PHP code into the application/config/database.php file by submitting specially crafted POST requests to the install endpoint after installation is complete. The vulnerability arises because the db_dbprefix parameter is not properly sanitized, enabling an attacker to break out of a PHP string literal and append malicious PHP statements. These statements are executed by the web server on every subsequent request, resulting in persistent remote code execution as the web server user.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the server hosting MaxSite CMS version 105.2. This leads to full compromise of the web application environment with the privileges of the web server process user. The vulnerability is persistent, as the injected code is stored in the configuration file and executed on every request, increasing the risk and potential damage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the install endpoint after installation and monitor for suspicious POST requests targeting this endpoint. Consider disabling or restricting write permissions to the application configuration files to prevent unauthorized modifications.