CVE-2026-87927: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in MaxSite MaxSite CMS

CVE-2026-87927 is a local file inclusion vulnerability in MaxSite CMS up to version 109.6. The vulnerability exists in the ajax and require-maxsite dispatchers, where improper control of filenames for include/require statements allows attackers to supply base64-encoded path traversal sequences. This bypasses path validation checks and permits unauthenticated attackers to execute privileged handler files and perform admin-gated actions, potentially exposing sensitive functionality.

An unauthenticated attacker can exploit this vulnerability to execute privileged handler files and invoke admin-level functionality without authentication. This could lead to unauthorized access to sensitive features within MaxSite CMS, potentially compromising the integrity and confidentiality of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected dispatchers and monitor for suspicious requests that may include base64-encoded path traversal sequences.