CVE-2026-22704: HAXcms stored XSS leading to account takeover

CVE-2026-22704 · Severity: low · CVSS 3.1 · Published 2026-01-13

HAXcms is a Node.js-based content management system. A stored cross-site scripting (XSS) vulnerability allows authenticated users to upload malicious HTML files that, when visited by an administrator, can steal authentication tokens and lead to complete account takeover. An attacker can gain full administrative control of the application without needing to guess passwords.

Technologies: HAX the Web HAXcms, @haxtheweb/haxcms-nodejs (npm). Vendors: HAX the Web, npm.

Quick answers

Is CVE-2026-22704 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-22704 being exploited in the wild.
How severe is CVE-2026-22704?
Low severity, with a CVSS score of 3.1, published 13 January 2026.
Which products and versions are affected?
HAX the Web HAXcms 11.0.6 through 24.x.x; fixed in 25.0.0, 11.0.6 to < 25.0.0; @haxtheweb/haxcms-nodejs (npm) SEMVER:introduced=11.0.6,fixed=25.0.0.
Is there a fix for CVE-2026-22704?
Yes. @haxtheweb/haxcms-nodejs (npm): upgrade to 25.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22704 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-22704?
Check whether you run HAX the Web HAXcms or @haxtheweb/haxcms-nodejs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @haxtheweb/haxcms-nodejs (npm): upgrade to 25.0.0 or later
    npm install @haxtheweb/haxcms-nodejs@25.0.0

Technical details

The vulnerability is a stored cross-site scripting (CWE-79) flaw in HAXcms's file upload functionality. An authenticated attacker uploads an HTML file containing JavaScript to the `/system/api/saveFile` endpoint. When a logged-in administrator is tricked into visiting the uploaded file URL, the malicious script executes in the administrator's browser context. The payload makes a fetch request to `/system/api/refreshAccessToken`, which automatically includes the administrator's `haxcms_refresh_token` cookie due to same-origin policy. The endpoint responds with a new valid JWT access token, which the JavaScript captures and exfiltrates to an attacker-controlled server. The attacker then possesses a valid administrator JWT and can impersonate the administrator with full application access. The fix (v25.0.0) forces HTML files in the `/files/` directory to be downloaded rather than executed inline, preventing script execution. The vulnerability affects versions 11.0.6 through 24.x.x.

Affected products

  • haxtheweb @haxtheweb/haxcms-nodejs 11.0.6 through 24.x.x; fixed in 25.0.0

Identifiers

  • CVE-2026-22704
  • GHSA-3fm2-xfq7-7778

Timeline

  • 2026-01-09: disclosed
  • 2026-01-09: patched: Version 25.0.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.