Read the docs
TI-2026-34111 Aliases CVE-2026-46397

haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0

Priority MEDIUM 62CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an Authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data). Version 26.0.0 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00289 21st percentileScored 2026-11-07
Fix Fixed haxcms-php (haxtheweb): 26.0.0haxcms-nodejs (haxtheweb): 26.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
haxthewebhaxcms-phpbefore 26.0.026.0.0Patch availableCNA
haxthewebhaxcms-nodejsbefore 26.0.026.0.0Patch availableCNA
  • haxcms-php Vendorhaxtheweb Affected before 26.0.0 Fixed in 26.0.0 Patch available CNA
  • haxcms-nodejs Vendorhaxtheweb Affected before 26.0.0 Fixed in 26.0.0 Patch available CNA

Remediation

  • Fix · CNA haxcms-php (haxtheweb) Fixed in 26.0.0
  • Fix · CNA haxcms-nodejs (haxtheweb) Fixed in 26.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46397

References

Other 1

  • TI-2026-34109 HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation CVSS 4.0CRITICAL 9.3
  • TI-2026-34105 HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis CVSS 4.0HIGH 8.7
  • TI-2026-27339 HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses CVSS 4.0HIGH 8.7
  • TI-2026-34113 Authenticated Remote Code Execution via File Overwrite CVSS 4.0CRITICAL 9.4
  • TI-2025-23152 HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution CVSS 3.1CRITICAL 10.0
  • TI-2026-34194 HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft CVSS 4.0CRITICAL 9.3
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences