What is CVE-2026-46394?

CVE-2026-46394 is a vulnerability in Haxtheweb Haxcms-php, classified under OS Command Injection. Published 2026-06-05.

Is CVE-2026-46394 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Haxtheweb Haxcms-php

CVE-2026-46394

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an OS command injection vulnerability exists in the Git.php library of the HAXcms PHP backend. The application constructs shell command strings u…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.008 (51.5th percentile) — read the EPSS interpretation.

Affected products

Haxtheweb Haxcms-php — versions < 26.0.0

Weakness classification (CWE)

CWE-78 — OS Command Injection

Public proof-of-concept exploits

shreyas-challa/CVE-2026-46394-haxcms-git-command-injection

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-46394?: CVE-2026-46394 is a vulnerability in Haxtheweb Haxcms-php, classified under OS Command Injection. Published 2026-06-05.
Is CVE-2026-46394 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.