CVE-2026-46397: falha de média gravidade em haxtheweb haxcms-php
haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.3%
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an Authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data). Version 26.0.0 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVEs relacionadas — haxtheweb haxcms-php
No mesmo produto, das mais perigosas para as menos.
CVE-2026-46394HIGHHAX CMS Vulnerable to Command Injection using Git.phpEPSS 0.8%CVE-2026-46400HIGHHAXCMS PHP has a File Upload Validation BypassEPSS 0.4%CVE-2026-46390MEDIUMHAX CMS has Unauthenticated Git Access via User-Controlled KeyEPSS 0.3%CVE-2026-46395CRITICALHAX CMS Vulnerable to Private Key Disclosure via Broken HMAC ImplementationEPSS 0.3%CVE-2026-46399CRITICALAuthenticated Remote Code Execution via File OverwriteEPSS 0.3%CVE-2026-46493HIGHhaxtheweb/haxcms-php uses insecure method for generating saltEPSS 0.3%