# CVE-2025-49141: HaxCMS-PHP command injection in gitImportSite

Source: https://junglewise.ai/threats/cve-2025-49141-haxcms-php-command-injection-in-gitimportsite  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-06-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-49141 · Severity: low · CVSS 3.1 · Published 2025-06-09

HaxCMS is a content management system used to build and manage websites. The gitImportSite feature allows authenticated users to import site content from a remote Git repository by providing a URL. An authenticated attacker can inject arbitrary operating system commands into this URL parameter, bypassing weak validation, to execute commands on the server and potentially steal sensitive data or compromise the system.

Technologies: [@haxtheweb/haxcms-nodejs (npm)](https://junglewise.ai/threats/technologies/haxtheweb-haxcms-nodejs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-49141 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-49141 being exploited in the wild.

**How severe is CVE-2025-49141?** Low severity, with a CVSS score of 3.1, published 9 June 2025.

**Which products and versions are affected?** @haxtheweb/haxcms-nodejs (npm) SEMVER:introduced=0,fixed=11.0.3.

**Is there a fix for CVE-2025-49141?** Yes. @haxtheweb/haxcms-nodejs (npm): upgrade to 11.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-49141 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2025-49141?** Check whether you run @haxtheweb/haxcms-nodejs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @haxtheweb/haxcms-nodejs (npm): upgrade to 11.0.3 or later

  ```sh
  npm install @haxtheweb/haxcms-nodejs@11.0.3
  ```


## Technical details

The vulnerability is an OS command injection (CWE-78) in the gitImportSite function within Operations.php. The function accepts a user-supplied URL from a POST request and validates it only using filter_var() and strpos() functions, which fail to block Bash special characters (e.g., semicolons, command substitution syntax). The unsanitized URL is subsequently passed to proc_open(), allowing an attacker to inject arbitrary shell commands. The attack requires prior authentication to obtain a valid token, but no further user interaction is needed. An authenticated attacker can craft a malicious URL (e.g., using semicolons or $(command) syntax) to execute arbitrary OS commands and exfiltrate output via HTTP responses. The vulnerability was patched in version 11.0.3 for haxcms-nodejs and 11.0.0 for haxcms-php.

## Affected products

- HAX HaxCMS-PHP <=10.0.6
- HAX HaxCMS-NodeJS <=10.0.6

## Identifiers

- CVE-2025-49141
- GHSA-g4cf-pp4x-hqgw

## Timeline

- 2025-06-09: disclosed: Advisory GHSA-g4cf-pp4x-hqgw published
- 2025-06-09: patched: HaxCMS-PHP 11.0.0 and HaxCMS-NodeJS 11.0.3 released

## References

- [https://github.com/haxtheweb/issues/security/advisories/GHSA-g4cf-pp4x-hqgw](https://github.com/haxtheweb/issues/security/advisories/GHSA-g4cf-pp4x-hqgw)

## Related threats

- [haxtheweb HAX CMS denial of service in createSite endpoint](https://junglewise.ai/threats/cve-2026-46357-haxtheweb-hax-cms-denial-of-service-in-createsite-endpoint)
- [HAX CMS account takeover via Stored XSS and token exposure](https://junglewise.ai/threats/cve-2026-46511-hax-cms-account-takeover-via-stored-xss-and-token-exposure)
- [haxtheweb HAX CMS stored XSS in video-player component](https://junglewise.ai/threats/cve-2026-46496-haxtheweb-hax-cms-stored-xss-in-video-player-component)
- [HAX CMS stored XSS in iframe elements](https://junglewise.ai/threats/cve-2026-46396-hax-cms-stored-xss-in-iframe-elements)
- [HAX CMS private key disclosure and JWT forgery in Node.js backend](https://junglewise.ai/threats/cve-2026-46395-hax-cms-private-key-disclosure-and-jwt-forgery-in-node-js-backend)