Executive brief
HAX CMS is a content management system used to build and manage microsites. A security flaw in its file upload system allows users with upload permissions to bypass security checks by disguising malicious scripts as harmless images. If exploited, an attacker could take full control of the web server, potentially leading to data theft or a complete service shutdown.
Technical details
An unrestricted file upload vulnerability exists in HAXCMS PHP due to insufficient validation in 'system/backend/php/lib/HAXCMSFile.php'. The application relies solely on a regular expression to check file extensions (e.g., .jpg, .png) without verifying the actual MIME type or file content before saving the file to the disk. An authenticated attacker can upload a PHP webshell with a double extension (e.g., 'shell.php.jpg') to bypass the regex check. Depending on the server configuration, this can lead to remote code execution (RCE) and full system compromise. The issue is addressed in version 25.0.0 by implementing more robust file type verification.
Affected products
- HAXtheWeb HAXCMS PHP 11.0.6 to 25.0.0
Timeline
- 2026-05-12: advisory: Original GitHub security advisory published
- 2026-06-05: disclosed: CVE-2026-46400 published to NVD