What is the CVSS score of CVE-2026-46397?

CVE-2026-46397 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-46397?

Yes, a patch is available for CVE-2026-46397. Update the affected software to the latest version immediately.

HAX CMS CVE-2026-46397

EUVD-2026-34902 MEDIUM

Path Traversal (CWE-22)

2026-06-05 GitHub_M

PHP Path Traversal

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 05, 2026 - 21:01 EUVD

Analysis Generated

Jun 05, 2026 - 19:51 vuln.today

DescriptionGitHub Advisory

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an Authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data). Version 26.0.0 patches the issue.

AnalysisAI

Local File Inclusion in HAX CMS's saveOutline endpoint allows an authenticated low-privileged user to read arbitrary files on the server by injecting path traversal sequences into the location field written to site.json. Both the PHP and NodeJS backend variants (haxtheweb/haxcms-php and haxtheweb/haxcms-nodejs) are affected across all versions prior to 26.0.0. There is no public exploit identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the confidentiality impact is rated High given that exfiltrable targets include /etc/passwd, application secrets, and web-server-readable configuration files.

Technical ContextAI

HAX CMS is a microsite management platform with two backend implementations: a PHP variant (cpe:2.3:a:haxtheweb:haxcms-php) and a NodeJS variant (cpe:2.3:a:haxtheweb:haxcms-nodejs). The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal). The saveOutline endpoint accepts a location field that is written into site.json without sufficient path sanitization or canonicalization. An attacker can supply a crafted value containing traversal sequences (e.g., ../../etc/passwd) that causes the application to resolve and expose files outside the intended web root. Because the web server process (typically www-data) reads these files, any file readable by that process is potentially exfiltrable. The dual PHP/NodeJS nature of the codebase suggests the path handling flaw exists in shared or parallel logic across both runtimes.

RemediationAI

Upgrade both the PHP and NodeJS variants of HAX CMS to version 26.0.0, which patches this vulnerability per the vendor advisory at https://github.com/haxtheweb/issues/security/advisories/GHSA-7fr7-h4p3-jjr8. If immediate upgrade is not feasible, the primary compensating control is to restrict access to the saveOutline endpoint at the web server or reverse proxy layer - block or authenticate-gate requests to this route for all users who do not require it, noting that this may disrupt legitimate outline editing workflows. Additionally, audit all existing site.json files for suspicious location values that contain traversal sequences, as exploitation leaves artifacts. Running the web server process under a dedicated, minimally privileged user with a restricted filesystem view (e.g., chroot, containers) would limit the blast radius of the LFI by reducing the set of readable files, though this does not eliminate the vulnerability.