CVE-2026-46397

haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0

State: Published
Severity: 6.5 Medium
Published: Jun 5, 2026
Updated: Jun 8, 2026
Reserved: May 13, 2026

Description

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an Authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data). Version 26.0.0 patches the issue.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73 External Control of File Name or Path

Affected Products

Product	Versions
haxcms-phphaxtheweb	< 26.0.0Affected
haxcms-nodejshaxtheweb	< 26.0.0Affected

References

https://github.com/haxtheweb/issues/security/advisories/GHSA-7fr7-h4p3-jjr8

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.