PT-2025-24328 · Maxsite+2 · Cms+1

V3Ged4G · Published 2025-06-06 · Updated 2025-10-28 · CVE-2025-12346

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions prior to 110

Description A flaw exists in MaxSite CMS that allows for unrestricted file uploads. This issue is related to the manipulation of the X-Requested-FileName and X-Requested-FileUpDir arguments within the HTTP Header Handler, specifically in the file application/maxsite/admin/plugins/auto post/uploads-require-maxsite.php. Remote exploitation is possible. The exploit is publicly available.

Recommendations Update MaxSite CMS to version 110 or later.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-12346

Affected Products

Cms

Maxsite Cms

References · 9

• 🔥 https://note-hxlab.wetolink.com/share/8QmDZCddHvyR · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12346 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12346 · Vendor Advisory
• https://twitter.com/johntroony/status/1930965849055089029 · Twitter Post
• https://t.me/CVEtracker/35927 · Telegram Post
• https://vuldb.com/?id.330136 · Note
• https://twitter.com/CVEnew/status/1983002398617710883 · Twitter Post
• https://vuldb.com/?submit.674551 · Note
• https://vuldb.com/?ctiid.330136 · Note