PT-2026-47028 · Hax Cms · Hax Cms+1

CVE-2026-46390 · Published 2026-06-05 · Updated 2026-06-06

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions HAX CMS versions 2.0.0 through 25.x

Description The gitlist plugin is exposed to unauthenticated users, which allows them to browse git repositories and git history without authentication.

Recommendations Update to version 26.0.0.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-46390

Affected Products

Hax Cms

Gitlist

References · 4

• 🔥 https://github.com/haxtheweb/issues/security/advisories/GHSA-6434-8rch-w65c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-46390 · Security Note
• https://twitter.com/infoflowcloud/status/2063205800261083193 · Twitter Post
• https://twitter.com/CVEnew/status/2063205039972257836 · Twitter Post