PT-2026-41975 · Npm+1 · @Haxtheweb/Haxcms-Nodejs+2

Published 2026-05-19 · Updated 2026-06-06 · CVE-2026-46393

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions HAX CMS versions prior to 26.0.0

Description An authenticated Server-Side Request Forgery (SSRF) allows users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and internal network access. The issue exists in the '/createSite' endpoint, where the build.files parameter accepts arbitrary URLs or local file paths. This input is processed without validation and fetched server-side using the file get contents() function. Because the bulk-import flag bypasses is uploaded file() validation, attackers can use various URL schemes to access external URLs, internal services, cloud metadata endpoints, or local file paths. The fetched content is then written to the 'sites//files/' directory, making it accessible via the web.

Recommendations Update to version 26.0.0. Avoid using the build.files parameter in the '/createSite' endpoint until the update is applied.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-46393

GHSA-Q862-GCGQ-5M6G

Affected Products

@Haxtheweb/Haxcms-Nodejs

Haxcms-Nodejs

Hax Cms Php

References · 7

• 🔥 https://github.com/haxtheweb/issues/security/advisories/GHSA-q862-gcgq-5m6g · Exploit
• https://osv.dev/vulnerability/GHSA-q862-gcgq-5m6g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46393 · Security Note
• https://github.com/haxtheweb/issues · Note
• https://twitter.com/infoflowcloud/status/2063205770540335286 · Twitter Post
• https://t.me/CVEtracker/55993 · Telegram Post
• https://twitter.com/CVEnew/status/2063205035643654581 · Twitter Post