PT-2026-47029 · Haxtheweb · Hax Cms Php

Published 2026-06-05 · Updated 2026-06-05 · CVE-2026-46392

Mitre

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the saveFile endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the .htaccess rule that forces Content-Disposition: attachment on HTML files is case-sensitive. An HTML file uploaded with an uppercase extension (.HTML, .Html, .HTM) is still served as text/html but the forced-download header never applies, so the browser renders it inline and executes any embedded JavaScript in the HAXcms origin. This bypasses the mitigation shipped for CVE-2026-22704. Version 26.0.0 contains a fix.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

CWE-178

Related Identifiers

CVE-2026-46392

Affected Products

Hax Cms Php

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-46392 · Security Note
• https://github.com/haxtheweb/issues/security/advisories/GHSA-hg33-w4j2-95qp · Note