CVE-2026-46397
haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an Authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data). Version 26.0.0 patches the issue.
| CWE | CWE-22 CWE-73 |
| Vendor | haxtheweb |
| Product | haxcms-php |
| Published | Jun 5, 2026 |
| Last Updated | Jun 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for haxtheweb haxcms-php
Be the first to know when new medium vulnerabilities affecting haxtheweb haxcms-php are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
haxtheweb / haxcms-php
< 26.0.0
haxtheweb / haxcms-nodejs
< 26.0.0