HAX CMS CVE-2026-46399

Exploitation requires an authenticated HAX CMS account on the PHP backend (CVSS PR:L) reachable over the network, with the ability to invoke the file-write functionality used to manipulate Git configuration; no user interaction or additional attack requirements are needed. Limiting factors: only the PHP backend prior to 26.0.0 is named as vulnerable (Node.js variant not confirmed), the attacker must hold valid credentials, and code execution is triggered when HAX CMS performs a Git operation that consumes the attacker-controlled filter directive, so deployments that do not invoke Git filters after the write may delay or prevent execution.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) signals a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high impact across the vulnerable system and high subsequent-system impact - a credible critical rating of 9.4. EPSS and SSVC data were not provided in the input, and the vulnerability is not in CISA KEV, so no quantitative exploitation probability is available. The PR:L requirement is the main mitigating factor: an attacker must already hold a valid HAX CMS account, which narrows the realistic threat surface to instances exposing registration, weak credentials, or multi-tenant deployments, while reducing risk for tightly access-controlled single-admin installations.

An attacker registers or compromises a low-privilege HAX CMS account, then uses the authenticated file-overwrite primitive to write a Git configuration that defines a malicious filter command (for example, a filter.X.clean entry pointing to a shell payload). When HAX CMS subsequently performs a Git checkout, add, or commit operation against the targeted repository, Git invokes the attacker's filter command, executing arbitrary code as the web server user. No public exploit identified at time of analysis.