CVE-2026-46393highCWE-918

CVE-2026-46393: falha de alta gravidade em haxtheweb haxcms-nodejs

HAXcms createSite SSRF Enables Arbitrary File Read

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar haxcms-php+ Monitorar haxcms-nodejs

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.2%
HAX CMS helps manage microsite universe with PHP or NodeJs backends. An authenticated Server-Side Request Forgery (SSRF) vulnerability in versions prior to 26.0.0 allows authenticated users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and internal network access. Version 26.0.0 contains a fix.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
haxtheweb · haxcms-nodejshaxtheweb · haxcms-php
CVEs relacionadas — haxtheweb haxcms-nodejs

No mesmo produto, das mais perigosas para as menos.

CVE-2026-46394HIGHHAX CMS Vulnerable to Command Injection using Git.phpEPSS 0.8%CVE-2026-46400HIGHHAXCMS PHP has a File Upload Validation BypassEPSS 0.4%CVE-2026-46390MEDIUMHAX CMS has Unauthenticated Git Access via User-Controlled KeyEPSS 0.3%CVE-2026-46395CRITICALHAX CMS Vulnerable to Private Key Disclosure via Broken HMAC ImplementationEPSS 0.3%CVE-2026-46399CRITICALAuthenticated Remote Code Execution via File OverwriteEPSS 0.3%CVE-2026-46397MEDIUMhaxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0EPSS 0.3%