CVE-2026-46393
CVE-2026-46393 · HAXcms createSite SSRF Enables Arbitrary File Read
This page contains facts from public vulnerability sources. Check the original advisory before updating.
HAX CMS helps manage microsite universe with PHP or NodeJs backends. An authenticated Server-Side Request Forgery (SSRF) vulnerability in versions prior to 26.0.0 allows authenticated users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and internal network access. Version 26.0.0 contains a fix.
CVSS 7.1 · High · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
haxcms-nodejs
- Versions
- < 26.0.0: Affected
No fix published
haxcms-php
- Versions
- < 26.0.0: Affected
No fix published
@haxtheweb/haxcms-nodejs npm
- Affected ranges
- SEMVER: < 26.0.0
Update to 26.0.0