CVE-2026-46401

HAX CMS versions prior to 26.0.0 have an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Git filter commands, leading to code execution on the HAX CMS server.

HAX CMS, which manages microsites with PHP or NodeJs backends, has a stored XSS vulnerability in versions prior to 26.0.0. The issue arises from improper sanitization of `<iframe>` elements, allowing execution of malicious JavaScript.

HAX CMS prior to version 26.0.1 uses `uniqid` for generating salts, which is unsuitable and can lead to predictable salts. Version 26.0.1 fixes this issue.

HAX CMS PHP versions 11.0.6 through 24.x.x have a file upload vulnerability that only validates file extensions via regex, without checking actual content or MIME type. Attackers can upload malicious files (e.g., PHP webshells) disguised as images, potentially leading to remote code execution.

In HAX CMS versions 25.0.0 to 25.0.0 (prior to 26.0.0), the haxcms_refresh_token cookie is set without the Secure flag. This allows transmission over unencrypted HTTP, making it vulnerable to theft via packet sniffing.

HAX CMS before version 26.0.0 contains an Authenticated Local File Inclusion (LFI) vulnerability in the saveOutline endpoint. A low-privileged user can read arbitrary files on the server by manipulating the location field in site.json. This allows exfiltration of sensitive system files.

HAX CMS, used to manage microsites with PHP or Node.js backends, crashes before version 26.0.0 when an authenticated attacker sends a crafted site creation request to the createSite endpoint. A single request can take the entire application offline, requiring a manual server restart.

HAX CMS prior to version 26.0.0 had a Stored XSS vulnerability that, combined with dynamic token exposure in the `/system/api/connectionSettings` endpoint, allowed an authenticated attacker to perform a complete account takeover of other users. The attacker could exploit this vulnerability to steal session tokens from the victim's browser.

HAX CMS, which manages microsites with PHP or NodeJs backends, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 26.0.0. This allows authenticated users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory.

HAX CMS versions up to 26.0.0 contain a stored XSS vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with page editing permissions can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name.