Executive brief
HAXcms is a Node.js-based content management system. A stored cross-site scripting (XSS) vulnerability allows authenticated users to upload malicious HTML files that, when visited by an administrator, can steal authentication tokens and lead to complete account takeover. An attacker can gain full administrative control of the application without needing to guess passwords.
Technical details
The vulnerability is a stored cross-site scripting (CWE-79) flaw in HAXcms's file upload functionality. An authenticated attacker uploads an HTML file containing JavaScript to the `/system/api/saveFile` endpoint. When a logged-in administrator is tricked into visiting the uploaded file URL, the malicious script executes in the administrator's browser context. The payload makes a fetch request to `/system/api/refreshAccessToken`, which automatically includes the administrator's `haxcms_refresh_token` cookie due to same-origin policy. The endpoint responds with a new valid JWT access token, which the JavaScript captures and exfiltrates to an attacker-controlled server. The attacker then possesses a valid administrator JWT and can impersonate the administrator with full application access. The fix (v25.0.0) forces HTML files in the `/files/` directory to be downloaded rather than executed inline, preventing script execution. The vulnerability affects versions 11.0.6 through 24.x.x.
Affected products
- haxtheweb @haxtheweb/haxcms-nodejs 11.0.6 through 24.x.x; fixed in 25.0.0
Timeline
- 2026-01-09: disclosed
- 2026-01-09: patched: Version 25.0.0 released with fix