CVE-2026-3395 | MaxSite CMS up to 109.1 MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection

A vulnerability, which was classified as critical, was found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code injection.

This vulnerability is registered as CVE-2026-3395. It is possible to launch the attack remotely. Furthermore, an exploit is available.

You should upgrade the affected component.

The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.