HAX CMS CVE-2026-46400

Requires a valid low-privileged HAX CMS PHP account that can reach the file upload functionality (CVSS PR:L), network reachability to the HAX CMS PHP backend, and a deployment where uploaded files are stored in a directory served by an active PHP handler (the default for haxcms-php media uploads). The vulnerable version range is haxcms-php 11.0.6 through anything below 25.0.0 - installations of the Node.js backend are not indicated as affected. No user interaction is required (UI:N), no special attack conditions apply (AT:N), and attack complexity is low (AC:L); the primary limiting factor is the authenticated-user prerequisite, which is materially weakened wherever self-registration, shared author accounts, or weak credentials are present.

Signals are largely consistent: CVSS v4.0 reports AV:N/AC:L/AT:N/PR:L/UI:N with full VC:H/VI:H/VA:H impact on the vulnerable component, meaning a low-privileged authenticated user over the network can achieve full RCE with no user interaction and no special attack conditions - a realistic priority for any internet-exposed HAX CMS PHP instance. The PR:L requirement (some authenticated account, e.g. a content author role) moderates risk versus a fully unauthenticated bug but is trivial to satisfy where self-registration or weak credentials exist. Confirmed actively exploited status is not present (no CISA KEV listing), EPSS data was not provided in the input, and no public exploit identified at time of analysis; however, CWE-434 webshell upload bugs are highly automatable and weaponization is typically rapid once a vendor advisory like GHSA-ffxv-9qv2-v2v8 is published, so this should be treated as a high-priority patch rather than a low-real-risk theoretical issue.

An attacker obtains or registers a low-privileged HAX CMS PHP account, then uses the media upload form to submit a file named like 'photo.php' (or a polyglot 'photo.php.jpg' depending on server handler mapping) containing a PHP webshell, which the regex extension check fails to block because content and MIME are never inspected. The attacker then requests the uploaded file's URL in a browser, the PHP interpreter executes the webshell, and the attacker gains arbitrary command execution as the web server user - typical follow-on actions include reading site secrets, pivoting to the database, and establishing persistence. No public exploit was identified at time of analysis, but CWE-434 patterns are routinely automated.