Loading vulnerability…
CVE-2026-3395 is a remote code injection vulnerability in MaxSite CMS up to version 109.1. The flaw affects the MarkItUp Preview AJAX endpoint in the administrative plugin component, specifically the preview-ajax.php file, where unsafe use of the eval function allows attacker-controlled input to be executed as code. A remote attacker can exploit the vulnerable endpoint by supplying crafted input that reaches the eval path, resulting in arbitrary code execution within the context of the web application. Public exploit material is available, and the vulnerability has been identified in active exploitation campaigns targeting internet-facing CMS deployments.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Repository purpose: a local Docker lab to reproduce and compare vulnerable vs patched behavior for CVE-2026-3395 in MaxSite CMS (unauthenticated RCE when `run_php` plugin is enabled). Exploit capability/chain (as documented): an unauthenticated attacker can POST to an administrative AJAX preview endpoint (`application/maxsite/admin/plugins/editor_markitup/preview-ajax.php`) via MaxSite’s `/ajax/<base64-path>` router. The endpoint passes attacker-controlled POST data through `mso_hook()`. When the `run_php` plugin is loaded, it interprets `[php]...[/php]` blocks and evaluates them with `eval()`, enabling arbitrary PHP execution (demonstrated with `system('id')`). Patch behavior: the fixed version adds an authentication gate (`if (!is_login()) die('no login');`) and a referer/CSRF check (`mso_checkreferer();`), preventing unauthenticated access. Repository structure: - README.md: explains the vulnerability, provides the base64 route, and gives curl PoC requests for vulnerable (8081) and patched (8082) instances. - docker-compose.yml: orchestrates two MariaDB backends and two CMS containers, plus two Alpine “seed” jobs that automatically run the MaxSite installer via HTTP POST and verify installation. - vuln/Dockerfile and patched/Dockerfile: build Apache+PHP images, clone MaxSite CMS from GitHub at specific commits (vulnerable commit `a446f4c...` and patched commit `08937a3...`), and write `application/maxsite/mso_config.php` to deterministically autoload the `run_php` plugin after installation (ensuring the RCE chain is reproducible in the lab). Overall, this is a PoC/lab environment rather than a standalone exploit tool: it provides reproducible vulnerable and patched targets and a safe proof-of-impact request demonstrating unauthenticated RCE in the vulnerable build.
Repository contains a single Python3 exploit script and a README describing CVE-2026-3395: an unauthenticated RCE in MaxSite CMS <= 109.1 when the run_php plugin is enabled. The exploit targets the MarkItUp editor AJAX routing mechanism by POSTing to /ajax/<base64_path>, where the base64 decodes to admin/plugins/editor_markitup/preview-ajax.php. It sets a spoofed Referer header (weak referrer validation bypass) and supplies a 'data' parameter containing a [php]...[/php] shortcode. The run_php plugin evaluates this shortcode (via eval()), enabling arbitrary PHP execution; the provided payload calls system() to run a netcat FIFO reverse shell back to attacker-supplied --lhost/--lport. Structure: (1) 'MaxSite CMS unauthenticated RCE.py' is the entry point with argparse options target/lhost/lport, constructs the base64 path and POST request using requests, and checks HTTP 200 for success; (2) README.md documents affected versions, vulnerable files (preview-ajax.php and autosave-post-ajax.php), prerequisites, example detection payload, reverse shell payload, and mitigation/patch references.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Unknown
The content only references the creation and update of a YAML record for CVE-2026-3395 in a repository or pull request workflow; no technical details about the vulnerability itself are provided.
A MaxSite CMS vulnerability listed among vulnerabilities actively exploited or operationally weaponized in July 2026.
Vulnerability in MaxSite CMS listed by the alert as being exploited in a large-scale CMS exploitation campaign.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.