CVE-2026-87930: Deserialization of Untrusted Data in MaxSite MaxSite CMS

CVE-2026-87930 describes a deserialization of untrusted data vulnerability in MaxSite CMS up to version 109.6. The vulnerability arises because the ci_session cookie is passed directly to PHP's unserialize() without class restrictions, allowing attackers to inject arbitrary PHP objects. Attackers can forge valid session cookies by leveraging a hardcoded encryption key, triggering magic methods within injected objects. This can corrupt the application state or enable remote code execution if exploitable gadget classes exist in the application environment.

An unauthenticated attacker can exploit this vulnerability to inject malicious PHP objects via a forged session cookie. This can lead to corruption of application state or remote code execution, posing a critical security risk. The vulnerability affects all users running vulnerable versions of MaxSite CMS, potentially allowing full compromise of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the use of unserialize() on untrusted data such as session cookies. Monitoring vendor communications for patches or official mitigations is strongly recommended.