CVE-2026-3395 is a code injection flaw in MaxSite CMS up to version 109.1. NVD scores it 7.3. The MarkItUp preview AJAX endpoint passes input to eval. Upgrade to 109.2. NVD notes that an exploit has been published, though it is not in CISA KEV.
What's affected
The record says MaxSite CMS up to 109.1 is affected, in preview-ajax.php under the editor_markitup admin plugin. It says an attack can be launched remotely and that an exploit has been published. It is not marked as exploited in the wild in CISA KEV. Version 109.2 fixes it, with patch commit 08937a3c5d672a242d68f53e9fccf8a748820ef3.
How to check if you're exposed
Check the CMS version in the admin area, and look for the file:
ls application/maxsite/admin/plugins/editor_markitup/preview-ajax.php
What to do now
- Update to 109.2 or later.
- Block direct access to the preview endpoint at your web server if you cannot update.
- Review the server for unexpected files and check access logs for requests to the endpoint.
- Rotate credentials if you find signs of misuse.
Why it matters
The record uses CWE-94 and CWE-74, code injection and injection. Passing request data to eval runs it as code. The record says the maintainer responded quickly.
Small CMS projects often ship admin helper endpoints such as previews, and these deserve a close look. An endpoint that evaluates input should never be reachable by anonymous visitors. If you run MaxSite, restrict the admin plugin paths to logged in users at the web server, keep the CMS on a supported version, and review the access logs for requests to the preview endpoint from before your update.
Because the record says an exploit has been published, assume scanning for this endpoint is possible and act on the update soon. Review web server logs for requests to the preview path, and compare the files in the plugin directory against a clean copy of the release.
Quick check
Is a public exploit confirmed?
The record says an exploit has been published. KEV does not list it.
Sources
Last reviewed: 19 October 2026.
