HAX CMS EUVD-2026-33286

Attacker must hold an authenticated HAX CMS account with permission to edit pages (CVSS PR:L) and must be able to reach the /system/api/saveNode endpoint over the network; exploitation also requires a victim user to subsequently view the poisoned page (CVSS UI:R). The specific technical condition is that the payload must inject an event handler attribute with no whitespace before the attribute name in order to bypass the HTML sanitizer in haxcms-nodejs ≤26.0.0 or haxcms-php ≤26.0.0. Limiting factors are the requirement for an existing editor role, the need for a separate victim to render the content, and that deployments where editors are fully trusted single-tenant authors face reduced practical impact.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N reflects a network-reachable, low-complexity attack that requires low privileges (an authenticated editor) plus user interaction (a victim viewing the poisoned page); the scope change and High confidentiality and integrity impacts drive the 8.7 score. No EPSS score, KEV listing, or public POC was provided, so real-world exploitation pressure appears low to moderate - this is best treated as a serious bug for any multi-tenant or community-edited HAX CMS deployment but not a drop-everything emergency for single-author sites where the editor is already trusted. The required PR:L authenticated editor role is the principal limiting factor; conversely, the stored nature and scope change mean a single low-privilege editor can impact admins and other site visitors, which is the key reason to patch promptly.

An attacker who holds (or phishes) a low-privilege editor account on a HAX CMS microsite submits a node update through /system/api/saveNode containing an HTML element whose event handler attribute (for example onerror) is concatenated to the preceding token without whitespace, slipping past the sanitizer. When a site administrator or other viewer later loads the page, the stored payload executes JavaScript in their browser session, enabling session hijacking, privilege escalation via authenticated admin actions, or defacement of additional microsites. No public POC is referenced, but the bypass technique is described concretely enough in the advisory to be reproducible by a competent attacker.