RCE in Haxtheweb Haxcms-nodejs
CVE-2026-46399
HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Gi…
EPSS: 0.003 (21.0th percentile) — read the EPSS interpretation.
Affected products
- Haxtheweb Haxcms-nodejs — versions < 26.0.0
- Haxtheweb Haxcms-php — versions < 26.0.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)