Quick answers
- Is CVE-2026-46399 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-46399 being exploited in the wild.
- How severe is CVE-2026-46399?
- Informational severity, with a CVSS score of 9.4, published 5 June 2026.
- Which products and versions are affected?
- Haxtheweb HAX CMS < 26.0.0.
- Is there a fix for CVE-2026-46399?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-46399 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-46399?
- Check whether you run Haxtheweb HAX CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The 'saveOutline' function in the PHP backend of HAX CMS fails to properly restrict the 'location' parameter, allowing it to target files within the site directory, including the '.git' folder. While the application attempts to strip path traversal sequences (../), it does not prevent writing to sensitive subdirectories already present in the relative root. An authenticated attacker can exploit this by overwriting '.git/config' to define a malicious Git filter. Because 'saveOutline' automatically triggers a Git commit, the malicious filter command is executed immediately on the server. This results in full remote code execution (RCE) with the privileges of the web server user. The issue is resolved in version 26.0.0.
Affected products
- haxtheweb HAX CMS (PHP version) < 26.0.0
Timeline
- 2026-05-12: advisory: Vendor advisory published via GitHub
- 2026-06-05: disclosed: CVE published to NVD