PT-2025-30348 · Unknown · Haxcms-Nodejs

Asareynolds · Published 2025-07-21 · Updated 2025-07-22 · CVE-2025-54134

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions HAX CMS NodeJs versions 11.0.8 and below

Description HAX CMS NodeJs, a system for managing microsite universes with a NodeJs backend, is susceptible to a crash issue. An authenticated attacker can trigger this issue by sending API requests to the listFiles and saveFiles endpoints without providing the necessary URL parameters. The application fails to handle exceptions resulting from modifications to user-modifiable URL parameters, leading to the application crash.

Recommendations Upgrade to version 11.0.9 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

CWE-248

CWE-703

Related Identifiers

CVE-2025-54134

GHSA-PJJ3-J5J6-QJ27

Affected Products

Haxcms-Nodejs

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54134.json · Exploit
• https://github.com/haxtheweb/haxcms-nodejs/commit/e9773d1996233f9bafb06832b8220ec2a98bab34 · Patch
• https://osv.dev/vulnerability/GHSA-pjj3-j5j6-qj27 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54134 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54134 · Vendor Advisory
• https://github.com/haxtheweb/issues/security/advisories/GHSA-pjj3-j5j6-qj27 · Note
• https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/routes/saveFile.js#L52 · Note
• https://github.com/haxtheweb/haxcms-nodejs · Note
• https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/routes/listFiles.js#L22 · Note
• https://twitter.com/VulmonFeeds/status/1947476567594057959 · Twitter Post
• https://twitter.com/CVEnew/status/1947405326824952179 · Twitter Post
• https://t.me/cvetracker/28336 · Telegram Post