HAX CMS EUVD-2026-34883

Requires an authenticated user with permission to use the saveFile upload endpoint (PR:L) and victim interaction - a separate user must visit the uploaded file's URL (UI:R) - on a HAX CMS PHP deployment prior to 26.0.0 served by an Apache server that honors the shipped .htaccess Content-Disposition rule. The bypass specifically depends on uploading the file with a non-lowercase HTML extension such as .HTML, .Html, or .HTM. Exploitation is limited where upload privileges are tightly held, where the front-end web server is not Apache (the .htaccess rule does not apply at all, but neither does the original mitigation, so behavior on nginx/IIS deployments is not confirmed by the available data), or where a WAF or CSP blocks inline script execution in the HAXcms origin.

The CVSS 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) signals network reach, low complexity, low privileges required, and user interaction with scope change - consistent with a stored XSS where an authenticated author uploads and an admin/other user visits the link. PR:L means an attacker needs at least a content-author-level account, which limits drive-by exploitation but is realistic in multi-tenant microsite deployments where many users hold upload rights. EPSS and KEV data were not provided in the intelligence feed, and the CVE is not listed in CISA KEV; no public exploit identified at time of analysis. The high impact rating is justified because the executed JavaScript runs in the HAXcms origin, enabling session hijacking of higher-privileged users - but realistic risk hinges on how loosely upload privileges are granted. Note: the description characterizes this as a same-origin script execution (XSS), yet the supplied Tags list 'Information Disclosure' - these are related but not identical, and the tag appears to be an upstream classification artifact rather than a contradiction of the advisory.

An attacker with a content-author account on a HAX CMS site uploads an HTML payload named payload.HTML containing JavaScript that exfiltrates the session cookie or issues authenticated API calls. They share the file URL with an administrator (or embed it in a microsite page); when the admin clicks the link, the browser receives text/html without the attachment header, renders the page inline, and executes the script under the HAXcms origin - letting the attacker hijack the admin session. No public POC has been identified, but the advisory describes the bypass clearly enough to reproduce.