CVE-2025-49141: HaxCMS-PHP command injection in gitImportSite

CVE-2025-49141 · Severity: low · CVSS 3.1 · Published 2025-06-09

HaxCMS is a content management system used to build and manage websites. The gitImportSite feature allows authenticated users to import site content from a remote Git repository by providing a URL. An authenticated attacker can inject arbitrary operating system commands into this URL parameter, bypassing weak validation, to execute commands on the server and potentially steal sensitive data or compromise the system.

Technologies: @haxtheweb/haxcms-nodejs (npm). Vendors: npm.

Quick answers

Is CVE-2025-49141 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-49141 being exploited in the wild.
How severe is CVE-2025-49141?
Low severity, with a CVSS score of 3.1, published 9 June 2025.
Which products and versions are affected?
@haxtheweb/haxcms-nodejs (npm) SEMVER:introduced=0,fixed=11.0.3.
Is there a fix for CVE-2025-49141?
Yes. @haxtheweb/haxcms-nodejs (npm): upgrade to 11.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-49141 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2025-49141?
Check whether you run @haxtheweb/haxcms-nodejs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @haxtheweb/haxcms-nodejs (npm): upgrade to 11.0.3 or later
    npm install @haxtheweb/haxcms-nodejs@11.0.3

Technical details

The vulnerability is an OS command injection (CWE-78) in the gitImportSite function within Operations.php. The function accepts a user-supplied URL from a POST request and validates it only using filter_var() and strpos() functions, which fail to block Bash special characters (e.g., semicolons, command substitution syntax). The unsanitized URL is subsequently passed to proc_open(), allowing an attacker to inject arbitrary shell commands. The attack requires prior authentication to obtain a valid token, but no further user interaction is needed. An authenticated attacker can craft a malicious URL (e.g., using semicolons or $(command) syntax) to execute arbitrary OS commands and exfiltrate output via HTTP responses. The vulnerability was patched in version 11.0.3 for haxcms-nodejs and 11.0.0 for haxcms-php.

Affected products

  • HAX HaxCMS-PHP <=10.0.6
  • HAX HaxCMS-NodeJS <=10.0.6

Identifiers

  • CVE-2025-49141
  • GHSA-g4cf-pp4x-hqgw

Timeline

  • 2025-06-09: disclosed: Advisory GHSA-g4cf-pp4x-hqgw published
  • 2025-06-09: patched: HaxCMS-PHP 11.0.0 and HaxCMS-NodeJS 11.0.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.