CVE-2026-35185

HAX CMS versions prior to 26.0.0 have an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Git filter commands, leading to code execution on the HAX CMS server.

HAX CMS, which manages microsites with PHP or NodeJs backends, has a stored XSS vulnerability in versions prior to 26.0.0. The issue arises from improper sanitization of `<iframe>` elements, allowing execution of malicious JavaScript.

HAX CMS prior to version 26.0.1 uses `uniqid` for generating salts, which is unsuitable and can lead to predictable salts. Version 26.0.1 fixes this issue.

HAX CMS versions prior to 26.0.0 have an improper session termination vulnerability where authentication tokens remain valid after user logout. Attackers with valid tokens can maintain persistent access to CMS functionality, bypassing session termination.

HAX CMS PHP versions 11.0.6 through 24.x.x have a file upload vulnerability that only validates file extensions via regex, without checking actual content or MIME type. Attackers can upload malicious files (e.g., PHP webshells) disguised as images, potentially leading to remote code execution.

In HAX CMS versions 25.0.0 to 25.0.0 (prior to 26.0.0), the haxcms_refresh_token cookie is set without the Secure flag. This allows transmission over unencrypted HTTP, making it vulnerable to theft via packet sniffing.

HAX CMS before version 26.0.0 contains an Authenticated Local File Inclusion (LFI) vulnerability in the saveOutline endpoint. A low-privileged user can read arbitrary files on the server by manipulating the location field in site.json. This allows exfiltration of sensitive system files.

HAX CMS, used to manage microsites with PHP or Node.js backends, crashes before version 26.0.0 when an authenticated attacker sends a crafted site creation request to the createSite endpoint. A single request can take the entire application offline, requiring a manual server restart.

HAX CMS prior to version 26.0.0 had a Stored XSS vulnerability that, combined with dynamic token exposure in the `/system/api/connectionSettings` endpoint, allowed an authenticated attacker to perform a complete account takeover of other users. The attacker could exploit this vulnerability to steal session tokens from the victim's browser.

HAX CMS, which manages microsites with PHP or NodeJs backends, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 26.0.0. This allows authenticated users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory.