Executive brief
HAX CMS is a content management system used to build and manage microsites. A security flaw allows users to upload malicious HTML files that bypass safety controls by using uppercase file extensions (like .HTML instead of .html). If an administrator or another user clicks a link to one of these files, an attacker can steal their login tokens, access their private site data, and effectively take over their account.
Technical details
A Stored XSS vulnerability exists in HAX CMS PHP's `saveFile` endpoint. While the PHP validator (HAXCMSFile.php) uses a case-insensitive regex to permit file uploads, the `.htaccess` security rule intended to force a download via `Content-Disposition: attachment` uses a case-sensitive `SetEnvIf` directive. Because Apache's MIME-type resolution for `text/html` is case-insensitive, files uploaded with extensions like `.HTML` or `.HTM` are served as executable HTML without the protective download header. An authenticated attacker can upload a malicious script that, when viewed by another user, executes in the HAXcms origin to exfiltrate JWTs, API tokens, and site metadata. This bypasses the previous mitigation for CVE-2026-22704. Version 26.0.0 fixes this by normalizing extensions to lowercase during upload.
Affected products
- haxtheweb HAX CMS PHP < 26.0.0
Timeline
- 2026-05-12: advisory: GitHub security advisory published
- 2026-06-05: disclosed: NVD publication date