MaxSite CMS up to version 109.6 allows unauthenticated attackers to tamper with the ci_session cookie that is passed directly to PHP's unserialize() function without any class restrictions. By forging a valid session cookie using the hardcoded encryption key, an attacker can inject arbitrary PHP objects. If gadget classes are present in the application, the magic methods of these objects can be invoked, corrupting application state or enabling arbitrary code execution. The vulnerability therefore threatens confidentiality, integrity, and availability of the affected system.

The affected product is MaxSite CMS, produced by MaxSite. Versions through 109.6 are affected. The vulnerability affects the session handling component that loads session data from the ci_session cookie stored in the client browser.

The CVSS score of 9.2 indicates a critical risk. No EPSS score is available, but the high severity and the fact that the attacker only needs to craft a cookie mean that exploitation is likely if a suitable gadget exists. The vulnerability is not listed in CISA's KEV catalog, yet the exploitation vector is remote and inexpensive, requiring only an HTTP(S) session cookie to be altered. Attackers can achieve code execution, data corruption, or privilege escalation once the malicious cookie is accepted by the server.