Is CVE-2026-46400 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46400 being exploited in the wild.

How severe is CVE-2026-46400?

Informational severity, with a CVSS score of 8.7, published 5 June 2026.

Which products and versions are affected?

HAXtheWeb HAXCMS PHP 11.0.6 to 25.0.0.

Is there a fix for CVE-2026-46400?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-46400 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-46400?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46400: HAXtheWeb HAXCMS PHP unrestricted file upload in HAXCMSFile.php

CVE-2026-46400 · Severity: info · CVSS 8.7 · Published 2026-06-05

HAX CMS is a content management system used to build and manage microsites. A security flaw in its file upload system allows users with upload permissions to bypass security checks by disguising malicious scripts as harmless images. If exploited, an attacker could take full control of the web server, potentially leading to data theft or a complete service shutdown.

Quick answers

Is CVE-2026-46400 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46400 being exploited in the wild.
How severe is CVE-2026-46400?: Informational severity, with a CVSS score of 8.7, published 5 June 2026.
Which products and versions are affected?: HAXtheWeb HAXCMS PHP 11.0.6 to 25.0.0.
Is there a fix for CVE-2026-46400?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-46400 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-46400?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unrestricted file upload vulnerability exists in HAXCMS PHP due to insufficient validation in 'system/backend/php/lib/HAXCMSFile.php'. The application relies solely on a regular expression to check file extensions (e.g., .jpg, .png) without verifying the actual MIME type or file content before saving the file to the disk. An authenticated attacker can upload a PHP webshell with a double extension (e.g., 'shell.php.jpg') to bypass the regex check. Depending on the server configuration, this can lead to remote code execution (RCE) and full system compromise. The issue is addressed in version 25.0.0 by implementing more robust file type verification.

Affected products

HAXtheWeb HAXCMS PHP 11.0.6 to 25.0.0

Timeline

2026-05-12: advisory: Original GitHub security advisory published
2026-06-05: disclosed: CVE-2026-46400 published to NVD

References

https://github.com/haxtheweb/issues/security/advisories/GHSA-ffxv-9qv2-v2v8

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.