The vendor has published a fix. Version details are below where the sources state them.
Steps
Written by AI from the record
Check your MaxSite CMS version and confirm whether you are running 109.1 or earlier (the fixed version is 109.2).
If you are on 109.1 or earlier, upgrade MaxSite CMS to 109.2 as soon as possible.
After upgrading, verify the site no longer serves the vulnerable preview-ajax.php behavior (confirm with your vendor/admin or staging test if you can).
A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 109.2 will fix this issue. This patch is called 08937a3c5d672a242d68f53e9fccf8a748820ef3. You should upgrade the affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.
In plain language
Written by AI from the record
CVE-2026-3395 is a MaxSite CMS security hole that lets an attacker run malicious code on your server without needing a login; if you run MaxSite CMS up to 109.1, you should treat it as an urgent patch.
In MaxSite CMS, a vulnerable MarkItUp editor AJAX endpoint (preview-ajax.php) allows unauthenticated remote attackers to inject and execute arbitrary code via an eval-based flaw in the endpoint, enabling remote code execution without user interaction.
If you're affected
Full site and server compromise
Data theft from your CMS
Website defacement or downtime
Malware deployment on hosting
What is it
This flaw is like leaving a back door in the code that processes “preview” requests. An attacker can send a specially crafted request to make the server run their own code—without needing to log in first. In practice, that can lead to your site being taken over or used to harm other systems you connect to.
Who is affected
This matters if you run MaxSite CMS (CMS / maxsite cms), especially if your site uses the MarkItUp editor and the preview AJAX endpoint is reachable. The findings indicate the attack does not require authentication or user interaction, so if the endpoint can be reached over the network, your exposure can be direct. The exact “reachable in default config” detail is not confirmed here, so the safest assumption is to patch if you are on a vulnerable version.
How urgent is it
This is RED because the vulnerability enables unauthenticated remote code execution, and the patch findings indicate sustained press attention for exploitation. Attackers can send requests over the network and execute arbitrary code without any login or user action, so delaying upgrade increases the window for compromise.
What to do — in detail
Confirm exposure
Identify the MaxSite CMS version you run.
If it is 109.1 or earlier, you are within the affected range described in the findings.
Confirm the MarkItUp editor plugin/feature is present and that the preview AJAX endpoint is reachable from the network.
If your public website includes the MarkItUp editor preview functionality, treat it as reachable.
Upgrade to the fixed version
Upgrade MaxSite CMS to 109.2.
The findings state: Fixed in 109.2 (for both “CMS” and “maxsite cms”).
Upgrade first in staging, then deploy to production after validation.
Verification after upgrade
Test the MarkItUp preview feature normally in a controlled way.
Confirm your production server reflects the upgraded behavior by re-checking the deployed CMS version and ensuring the known vulnerable code path is no longer present.
If you cannot patch immediately
Put your website behind strict access controls and limit exposure of editor/preview-related endpoints at the web server or reverse proxy level (allow only trusted IPs, or restrict the endpoint to authenticated/admin use if your setup supports that).
Monitor for unusual POST/GET requests targeting the MarkItUp preview AJAX endpoint path and for unexpected changes to server-side files.
What to monitor after upgrading
Application logs for requests to the preview-ajax.php endpoint.
Server integrity checks (new/changed files in CMS/plugin directories).
Unusual outbound connections from your hosting environment.
CISA KEV
Not listed in the provided findings (KEV not reported), but exploitation is still indicated by sustained press attention.
Technical context
What’s happening
Vulnerability type / weakness: CWE-74 (Injection) and CWE-94 (Code Injection), consistent with an eval code injection issue in the MarkItUp preview AJAX endpoint.
Mechanism: A flaw in application/maxsite/admin/plugins/editor_markitup/preview-ajax.php allows an attacker to inject and execute arbitrary code.
Trigger: The attacker sends a crafted network request to the vulnerable AJAX endpoint.
Exposure and prerequisites
Authentication required: No.
User interaction: None.
Preconditions: None stated in the findings.
Reachability: “reachable in default config” is unknown in the findings, but the capability described is remote and unauthenticated, so you should assume exposure if the endpoint is reachable publicly.
Exploitation status
KEV: Not listed in the provided findings.
Exploitation: Press attention is described as sustained, and the technical backstop notes the exploit has been published and may be used.
Exploit code: No public exploit code is recorded in the provided findings.
Severity
The findings describe Remote code execution without authentication or user interaction, which is why the overall verdict is RED.
Fix
MaxSite CMS up to 109.1 is affected.
Fixed in 109.2 (commit 08937a3c5d672a242d68f53e9fccf8a748820ef3).
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
