Which versions of HAX CMS are affected by CVE-2026-46399?

HAX CMS deployments face remote code execution exposure through any administrative credential compromise, affecting all versions before 26.0.0 and creating a critical insider threat and account…. A patch is available.

How to fix or mitigate CVE-2026-46399?

Within 24 hours: Inventory all HAX CMS installations and document versions; audit administrative account activity for Git configuration changes; restrict Git filter command access to a single trusted administrator role. Within 7 days: Review and rotate administrative credentials; audit logs for lateral movement or file modifications by administrative accounts; implement IP whitelisting for administrative access. Within 30 days: Upgrade to HAX CMS version 26.0.0 or later when available; enforce multi-factor authentication on all administrative accounts; implement network-level segmentation isolating Git configuration interfaces from standard user networks.

HAX CMS CVE-2026-46399

Q: What is the CVSS score of CVE-2026-46399?

CVE-2026-46399 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34880 CRITICAL

External Control of System or Configuration Setting (CWE-15)

2026-06-05 GitHub_M

PHP RCE

9.4

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 05, 2026 - 20:02 EUVD

Analysis Generated

Jun 05, 2026 - 19:27 vuln.today

CVSS changed

Jun 05, 2026 - 19:22 NVD

9.4 (CRITICAL)

DescriptionGitHub Advisory

HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Git filter commands and achieve code execution on the HAX CMS server. Version 26.0.0 patches the issue.

AnalysisAI

Authenticated remote code execution affects HAX CMS PHP backend versions prior to 26.0.0, where attackers with valid credentials can configure malicious Git filter commands to overwrite files and execute arbitrary code on the server. The flaw carries a CVSS 4.0 score of 9.4 due to full compromise of confidentiality, integrity, and availability with cascading subsequent system impact. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

HAX CMS is a content management system for managing microsite collections, offered with both PHP and Node.js backends (per CPE entries haxcms-php and haxcms-nodejs, though only the PHP variant is named as vulnerable here). The root cause maps to CWE-15 (External Control of System or Configuration Setting), meaning authenticated user input is allowed to influence Git configuration that the server later acts upon. Git's filter driver mechanism (filter.<name>.clean / smudge) executes shell commands during checkout or commit operations, so an attacker able to write attacker-controlled values into a repository's git config can pivot a file-overwrite primitive into command execution under the web server's user context.

RemediationAI

Upgrade the PHP backend of HAX CMS to vendor-released patch 26.0.0 or later, per the GHSA-q759-vxg8-vq5j advisory at https://github.com/haxtheweb/issues/security/advisories/GHSA-q759-vxg8-vq5j. If immediate upgrade is not possible, restrict HAX CMS account creation and review existing user accounts to enforce least privilege, since exploitation requires authenticated access; additionally place the application behind network access controls or VPN so the authenticated endpoint is not internet-reachable, and audit any managed Git repositories for unexpected filter.* directives in .git/config that could indicate attempted abuse. These compensating controls reduce blast radius but do not eliminate risk from any already-compromised low-privilege account.