What is CVE-2026-70553?
CVE-2026-70553 is a critical remote code execution vulnerability in MaxSite CMS that allows unauthenticated attackers to inject arbitrary PHP code via crafted POST requests to the install endpoint after installation is complete. Affected users should immediately remove or restrict access to the "install" directory to mitigate the risk.
Azərbaycanca: CVE-2026-70553, MaxSite CMS-də quraşdırma sonrası "install endpoint"-ə xüsusi POST sorğusu göndərərək autentifikasiya olmadan uzaqdan kod icrasına (RCE) imkan verən kritik zəiflikdir. Təsirə məruz qalan sistemlərdə administratorlar dərhal "install" qovluğunu silməli və ya girişi məhdudlaşdırmalıdır.
Related CVEs
link basis: same weakness class CWE-94
FAQ2
What condition must be met to achieve remote code execution using CVE-2026-70553?
To exploit this vulnerability, the MaxSite CMS installation process must already be complete, but the 'install endpoint' must remain accessible. An attacker can inject arbitrary PHP code without authentication by sending crafted POST requests to that endpoint.
What is the most effective mitigation step to protect against CVE-2026-70553?
The most effective mitigation is to immediately remove the 'install' directory after setup is complete or restrict access to this directory.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.