by Kastro
Paper/Archive/CVE-2026-46399

CVE-2026-46399

haxtheweb haxcms-nodejs — Authenticated Remote Code Execution via File Overwrite

EPSS 0.3%public exploitCVSS 9.4
critical.is priorityof 100
43
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 21.6.216 × 204.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Git filter commands and achieve code execution on the HAX CMS server. Version 26.0.0 patches the issue.

Affected

ProductAffectedFixed inSource
haxcms-nodejs< 26.0.0–CNA
haxcms-php< 26.0.0–CNA

Scores by source

GitHub_M (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/haxtheweb/issues/security/advisories/GHSA-q759-vxg8-vq5j