CVE-2026-70554 is a PHP object injection vulnerability in MaxSite CMS version 0.78. The application unserializes attacker-controlled serialized data from the maxsite_comuser cookie without validation or class allowlisting. This allows unauthenticated attackers to craft malicious serialized PHP objects that trigger magic methods during deserialization, enabling property-oriented programming attacks or remote code execution using gadget chains like those involving SoapClient or Imagick extensions. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity. No official patch or remediation guidance is currently available from the vendor.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the affected system. This can lead to full system compromise, data theft, or service disruption. The vulnerability is critical due to its ease of exploitation (no authentication required) and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the vulnerable application, implement web application firewall (WAF) rules to detect and block malicious serialized payloads, and monitor for suspicious activity related to the maxsite_comuser cookie. Avoid using the affected version 0.78 in production environments.