HAX CMS EUVD-2026-34881

The gitlist plugin is present and active by default in HAX CMS PHP versions 2.0.0 and later - no special configuration is required to expose it. Exploitation requires no authentication (CVSS PR:N), no user interaction (CVSS UI:N), and is reachable over the network with low attack complexity (CVSS AV:N/AC:L), meaning any internet-accessible HAX CMS PHP instance in the affected version range is exploitable without preconditions. Exploitation is bounded to read-only repository and history access - CVSS VI:N and VA:N confirm no write or availability impact. The Node.js backend variant is not confirmed vulnerable based on the CPE data provided. The primary limiting factor for impact is what sensitive content is present in the exposed repositories, not any technical barrier to exploitation.

The CVSS 4.0 score of 6.9 is consistent with the vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N: network-accessible, low complexity, requiring no privileges or user interaction, with limited confidentiality impact on the vulnerable component and no integrity or availability impact. The VC:L rating reflects partial rather than full disclosure - repository contents are browsable but the host system is not directly compromised. No EPSS score was supplied in the input data, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, so active exploitation is unconfirmed. Despite the limited CVSS confidentiality rating, real-world risk is substantially dependent on what is present in git history: hardcoded credentials, API keys, internal configuration, or proprietary source code would materially elevate the practical impact well beyond what VC:L captures. For any public-facing HAX CMS PHP deployment, this should be treated as a genuine remediation priority rather than a low-risk informational finding.

An unauthenticated attacker discovers a public-facing HAX CMS PHP instance via passive reconnaissance (e.g., search engine dorking or scanning for known CMS paths). The attacker sends a standard HTTP GET request to the exposed gitlist plugin endpoint, immediately receiving a browsable view of the git repository tree and commit history with no credentials required. From commit history, the attacker extracts hardcoded secrets, configuration values, or internal source code present in prior commits, which may then be used for lateral movement or further attacks against dependent systems.