Executive brief
HAX CMS is a content management system used to build and manage microsites. A security flaw allows logged-in users with low-level permissions to access sensitive files on the server that they should not be able to see. This could lead to the exposure of system passwords, configuration files, and other private data, potentially allowing an attacker to further compromise the server.
Technical details
An authenticated Local File Inclusion (LFI) vulnerability exists in the HAXCMS saveOutline endpoint due to improper path validation. The application attempted to mitigate path traversal by using str_replace to remove '../' and './' sequences, but this filter can be bypassed using nested patterns (e.g., '....//'). An attacker with low-privileged credentials can manipulate the 'location' field in the saveOutline API to write arbitrary paths into site.json, subsequently allowing them to read sensitive files like /etc/passwd or application secrets accessible to the web server user. The vulnerability affects both PHP and Node.js backends and is resolved in version 26.0.0.
Affected products
- HAX the Web HAXCMS <= 25.0.0
- HAX the Web @haxtheweb/haxcms-nodejs <= 25.0.0
Timeline
- 2026-05-12: advisory: Original GitHub security advisory published
- 2026-06-05: disclosed: NVD publication date
- 2026-06-05: patched: Version 26.0.0 released to address the issue