CVE-2026-46397CWE-22CWE-73

haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0

Medium · published June 5, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
35.6
In the wild
Unconfirmed
What it is

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an Authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data). Version 26.0.0 patches the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00424 · 35.6th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-73 · External Control of File Name or Path
Published
2026-06-05T19:11Z
EPSS history
Timeline
  • 05 JUN 19:11Z
    haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0
    cvelistv5