PT-2026-47028 · Haxtheweb · Hax Cms Php

Published 2026-06-05 · Updated 2026-06-05 · CVE-2026-46390

NVD

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history. Version 26.0.0 patches the issue.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-46390

Affected Products

Hax Cms Php

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-46390 · Security Note
• https://github.com/haxtheweb/issues/security/advisories/GHSA-6434-8rch-w65c · Note