CVE-2026-46400
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
HAX CMS PHP versions 11.0.6 through 24.x.x have a file upload vulnerability that only validates file extensions via regex, without checking actual content or MIME type. Attackers can upload malicious files (e.g., PHP webshells) disguised as images, potentially leading to remote code execution.
Risk Assessment
Risk of remote code execution on the server by uploading a fake image file containing malicious PHP code.
Recommendation
Upgrade HAX CMS to version 25.0.0 or later, which contains the fix.
Other vulnerabilities in HAX CMS
See all- CVE-2026-46399Critical
HAX CMS versions prior to 26.0.0 have an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Git filter commands, leading to code execution on the HAX CMS server.
- CVE-2026-46396Critical
HAX CMS, which manages microsites with PHP or NodeJs backends, has a stored XSS vulnerability in versions prior to 26.0.0. The issue arises from improper sanitization of `<iframe>` elements, allowing execution of malicious JavaScript.
- CVE-2026-46493High
HAX CMS prior to version 26.0.1 uses `uniqid` for generating salts, which is unsuitable and can lead to predictable salts. Version 26.0.1 fixes this issue.
- CVE-2026-46401Medium
HAX CMS versions prior to 26.0.0 have an improper session termination vulnerability where authentication tokens remain valid after user logout. Attackers with valid tokens can maintain persistent access to CMS functionality, bypassing session termination.
- CVE-2026-46398High
In HAX CMS versions 25.0.0 to 25.0.0 (prior to 26.0.0), the haxcms_refresh_token cookie is set without the Secure flag. This allows transmission over unencrypted HTTP, making it vulnerable to theft via packet sniffing.
- CVE-2026-46397Medium
HAX CMS before version 26.0.0 contains an Authenticated Local File Inclusion (LFI) vulnerability in the saveOutline endpoint. A low-privileged user can read arbitrary files on the server by manipulating the location field in site.json. This allows exfiltration of sensitive system files.
- CVE-2026-46357Medium
HAX CMS, used to manage microsites with PHP or Node.js backends, crashes before version 26.0.0 when an authenticated attacker sends a crafted site creation request to the createSite endpoint. A single request can take the entire application offline, requiring a manual server restart.
- CVE-2026-46511High
HAX CMS prior to version 26.0.0 had a Stored XSS vulnerability that, combined with dynamic token exposure in the `/system/api/connectionSettings` endpoint, allowed an authenticated attacker to perform a complete account takeover of other users. The attacker could exploit this vulnerability to steal session tokens from the victim's browser.
- CVE-2026-46393High
HAX CMS, which manages microsites with PHP or NodeJs backends, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 26.0.0. This allows authenticated users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory.
- CVE-2026-48527High
HAX CMS versions up to 26.0.0 contain a stored XSS vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with page editing permissions can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name.
Original NVD description (English source)
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 11.0.6 and prior to version 25.0.0, the file upload functionality in HAXCMS PHP only validates file extensions using a regex pattern without checking the actual file content or MIME type. This allows attackers to upload malicious files (e.g., PHP webshells) disguised as legitimate image files, potentially leading to remote code execution. Version 25.0.0 contains a fix for the issue.