CVE-2026-46400 Details
Description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 11.0.6 and prior to version 25.0.0, the file upload functionality in HAXCMS PHP only validates file extensions using a regex pattern without checking the actual file content or MIME type. This allows attackers to upload malicious files (e.g., PHP webshells) disguised as legitimate image files, potentially leading to remote code execution. Version 25.0.0 contains a fix for the issue.
A vulnerability in HAX CMS versions 11.0.6 prior to 25.0.0 allows file upload validation to be bypassed. The issue arises because the file upload feature in the PHP version of HAX CMS only checks file extensions against a regex pattern, without verifying the actual file content or MIME type. This flaw enables attackers to upload malicious files, such as PHP web shells, disguised as legitimate image files, potentially leading to remote code execution. The vulnerability exists in the file 'system/backend/php/lib/HAXCMSFile.php', where the extension check is performed after the file has been saved to disk, leaving a window for exploitation.
Users are advised to update to HAX CMS version 25.0.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 5, 2026CISA-ADP
Assessed Jun 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/haxtheweb/issues/security/advisories/GHSA-ffxv-9qv2-v2v8 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/haxtheweb/issues/security/advisories/GHSA-ffxv-9qv2-v2v8 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HAXCMS | >= 11.0.6, < 25.0.0 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | New CVE Received | [email protected] |