dbcve.org
Maxsite CmsApplication · Max 3000

CVE-2026-3395

CRITICAL · 9.8 CVSS v3.1 Published 2026-03-01
Fix available
A fix is available. Upgrade to 109.2 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click Patch available

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 109.2 will fix this issue. This patch is called 08937a3c5d672a242d68f53e9fccf8a748820ef3. You should upgrade the affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

MaxSite CMS contains a critical code injection vulnerability in the MarkItUp editor's preview-ajax.php endpoint, where use of the PHP eval() function allows remote attackers to execute arbitrary PHP code by manipulating input to the affected component.

MitigationImmediately upgrade MaxSite CMS to version 109.2 or later, which contains the patch that removes the vulnerable eval() call in the MarkItUp Preview AJAX endpoint.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Maxsite CmsApplication
Affected:< 109.2

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Confirm MaxSite CMS is installed
    Check your web server for MaxSite CMS files - look for the main index.php and common MaxSite CMS directories (such as /application/, /maxsite/, or /uploads/) in your web root.
    Affected if MaxSite CMS files are found in the web document root
  2. Determine installed MaxSite CMS version
    Check the version file or header in MaxSite CMS - commonly found in a version.php, config.php, or the main index.php file. Alternatively, look at the admin dashboard footer which often displays the version.
    Affected if The installed version is lower than 109.2 (for example, 109.1, 109.0, or earlier releases)
  3. Locate the MarkItUp editor component
    Search for the MarkItUp editor directory in your MaxSite CMS installation - look for directories or files containing 'markitup' in the name, typically under /application/ or a plugins folder.
    Affected if The MarkItUp editor directory or files exist in the installation
  4. Check for the vulnerable preview-ajax.php file
    Locate the preview-ajax.php file within the MarkItUp editor path - common paths include /application/common/markitup/preview-ajax.php or similar paths under a plugins or editor directory.
    Affected if The preview-ajax.php file exists in the MarkItUp editor directory
  5. Verify eval() usage in preview-ajax.php
    Open the preview-ajax.php file and search for the string 'eval(' within the code. If the file contains an eval() call that processes user input, the vulnerability is present.
    Affected if The file contains an eval() function call that processes input without sanitization

A user is affected if MaxSite CMS version is below 109.2 AND the MarkItUp editor with the vulnerable preview-ajax.php file containing eval() is present and accessible on their server.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 109.2 or later
Fixed in 109.2
Vendor patch github.com →
Interim mitigation

Immediately upgrade MaxSite CMS to version 109.2 or later, which contains the patch that removes the vulnerable eval() call in the MarkItUp Preview AJAX endpoint.

Recommended fix High confidence

109.2

  1. 1. Back up your current MaxSite CMS installation and database before making any changes.
  2. 2. Download MaxSite CMS version 109.2 from the official source (https://max-3000.com/) or the GitHub repository.
  3. 3. Replace all files in your existing installation with the files from version 109.2, or perform a fresh installation of version 109.2.
  4. 4. Verify that the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php has been updated and no longer contains the vulnerable eval() usage.
  5. 5. Test the MarkItUp editor preview functionality to ensure the CMS is functioning correctly after the upgrade.
  6. 6. Monitor vendor announcements for any subsequent security updates.
Caveat Review plugin compatibility as third-party plugins may need updates for version 109.2

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Maxsite Cms Scoped from the published advisory
  • Consultation2.0 h
  • Implementation2.0 h
  • Testing2.0 h
  • Review / QA1.0 h
7.0 hours of engineering $1,240
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,984.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-3395 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-3395 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data