CVE-2026-46393: HAXcms SSRF and arbitrary file read in createSite endpoint

CVE-2026-46393 · Severity: high · CVSS 4 · Published 2026-06-05

HAX CMS is a content management system used to build and manage microsites. A security flaw allows logged-in users to trick the server into fetching sensitive data from internal networks or the server's own files. This could lead to the exposure of private system files, internal network data, or cloud service credentials, which are then made publicly accessible through the website's file directory.

Technologies: HAX the Web HAXcms, @haxtheweb/haxcms-nodejs (npm). Vendors: HAX the Web, npm.

Quick answers

Is CVE-2026-46393 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46393 being exploited in the wild.
How severe is CVE-2026-46393?
High severity, with a CVSS score of 4, published 5 June 2026.
Which products and versions are affected?
HAX the Web HAXcms <= 25.0.0; @haxtheweb/haxcms-nodejs (npm) <= 25.0.0, SEMVER:introduced=0,fixed=26.0.0.
Is there a fix for CVE-2026-46393?
Yes. @haxtheweb/haxcms-nodejs (npm): upgrade to 26.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46393 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46393?
Check whether you run HAX the Web HAXcms or @haxtheweb/haxcms-nodejs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @haxtheweb/haxcms-nodejs (npm): upgrade to 26.0.0 or later
    npm install @haxtheweb/haxcms-nodejs@26.0.0

Technical details

An authenticated Server-Side Request Forgery (SSRF) exists in the 'createSite' endpoint of HAXcms due to insufficient validation of the 'build.files' parameter. The application passes attacker-controlled 'tmp_name' values directly to 'file_get_contents()' when the bulk-import flag is enabled, bypassing standard 'is_uploaded_file()' checks. An attacker with low-level authentication can use this to fetch arbitrary local files (e.g., /etc/passwd), internal network resources, or cloud metadata (e.g., AWS/IMDS). The fetched content is subsequently saved into a web-accessible directory, allowing for easy exfiltration. The vulnerability is addressed in version 26.0.0.

Affected products

  • haxtheweb haxcms-nodejs <= 25.0.0
  • haxtheweb haxcms-php <= 25.0.0

Identifiers

  • CVE-2026-46393
  • GHSA-q862-gcgq-5m6g

Timeline

  • 2026-05-12: advisory: GitHub Security Advisory published by vendor
  • 2026-06-05: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.