Skip to content
CVE PROGRAM SOURCE RECORD9.4 Critical

CVE-2026-46399

Authenticated Remote Code Execution via File Overwrite

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Git filter commands and achieve code execution on the HAX CMS server. Version 26.0.0 patches the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

haxtheweb haxcms-nodejs

  • < 26.0.0affected

haxtheweb haxcms-php

  • < 26.0.0affected

References