A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php …

A critical code injection vulnerability (CVE-2026-3395) has been discovered in MaxSite CMS versions up to 109.1. The flaw affects the eval function in the MarkItUp Preview AJAX Endpoint file (application/maxsite/admin/plugins/editor_markitup/preview-ajax.php). Attackers can exploit this vulnerability remotely to inject malicious code. The exploit has been publicly disclosed and is available for use. The vulnerability has been patched in version 109.2 with commit 08937a3c5d672a242d68f53e9fccf8a748820ef3. Users are strongly advised to upgrade immediately to the fixed version.