Executive brief
HAX CMS is a content management system used to build and manage microsites. A vulnerability in the NodeJS version of the application allows a logged-in user to crash the entire server by sending a single malicious request. This results in a total service outage that requires a manual restart by an administrator to restore access for all users.
Technical details
A Denial of Service (DoS) vulnerability exists in HAX CMS (NodeJS backend) prior to version 26.0.0 due to improper input validation in the site creation flow. The 'createSite' endpoint fails to properly handle file objects during remote imports; specifically, it passes a file object missing the 'originalname' property to HAXCMSFile.save(). This causes a TypeError when the code attempts to call .replace() on an undefined property, resulting in an immediate process crash. An authenticated attacker with low privileges can trigger this crash with a single HTTP POST request to the /system/api/createSite endpoint. The issue is resolved in version 26.0.0.
Affected products
- haxtheweb HAX CMS (NodeJS backend) < 26.0.0
Timeline
- 2026-05-13: advisory: GitHub Security Advisory published
- 2026-06-05: disclosed: CVE published to NVD