Which versions of HAX CMS are affected by EUVD-2026-34894?

HAX CMS versions 11.0.6 through 24.x contain a high-severity file upload vulnerability allowing authenticated users to execute arbitrary code on the web server.. A patch is available.

How to fix or mitigate EUVD-2026-34894?

Within 24 hours: Identify all HAX CMS instances and versions in use across your environment. Within 7 days: Apply available vendor patches to all affected HAX CMS installations (versions 11.0.6-24.x) and verify successful deployment. Within 30 days: Conduct security audit of web server file permissions, review access controls, and analyze server logs for exploitation attempts during the vulnerable period.

HAX CMS EUVD-2026-34894

Q: What is the CVSS score of EUVD-2026-34894?

EUVD-2026-34894 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-46400 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-05 GitHub_M

PHP File Upload RCE

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 21:50 vuln.today

Patch available

Jun 05, 2026 - 21:01 EUVD

CVSS changed

Jun 05, 2026 - 20:22 NVD

8.7 (HIGH)

CVE Published

Jun 05, 2026 - 19:15 nvd

UNKNOWN (no severity yet)

DescriptionGitHub Advisory

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 11.0.6 and prior to version 25.0.0, the file upload functionality in HAXCMS PHP only validates file extensions using a regex pattern without checking the actual file content or MIME type. This allows attackers to upload malicious files (e.g., PHP webshells) disguised as legitimate image files, potentially leading to remote code execution. Version 25.0.0 contains a fix for the issue.

AnalysisAI

Arbitrary file upload in HAX CMS (PHP backend) versions 11.0.6 through 24.x allows authenticated remote attackers to upload PHP webshells disguised as images by abusing a regex-only extension check that ignores MIME type and content inspection, leading to remote code execution on the web server. CVSS v4.0 scores this 8.7 (High) with PR:L indicating low-privilege authentication is required, and no public exploit was identified at time of analysis although the underlying CWE-434 pattern is highly automatable.

Technical ContextAI

HAX CMS is an open-source headless content management system for managing 'microsite universes' with either PHP or Node.js backends; this issue is scoped specifically to the PHP backend identified by the CPE cpe:2.3:a:haxtheweb:haxcms-php. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the upload handler validates only the trailing filename extension via a regex pattern, with no inspection of magic bytes, no MIME sniffing, and no enforcement that uploaded content actually matches an image format. Because the resulting file is written into a web-accessible directory served by the PHP interpreter, any uploaded .php (or PHP-handler-mapped extension such as .phtml or polyglot file) is executed when requested. This is a classic webshell delivery pattern made possible by extension-only allow/deny logic.

RemediationAI

Vendor-released patch: upgrade haxcms-php to version 25.0.0 or later, which adds proper file content/MIME validation as documented in GitHub Security Advisory GHSA-ffxv-9qv2-v2v8 (https://github.com/haxtheweb/issues/security/advisories/GHSA-ffxv-9qv2-v2v8) and tracked as EUVD-2026-34894. Where immediate upgrade is not possible, compensating controls include disabling the file upload endpoint for untrusted roles (trade-off: breaks legitimate author workflows that rely on media uploads), placing the uploads directory outside the document root or serving it from a path where PHP execution is disabled via web server configuration such as an Apache .htaccess with 'php_flag engine off' or an nginx location block that forces a static MIME handler (trade-off: requires server-level changes and will not protect against polyglot files served through other interpreters), and restricting access to the CMS administrative surface to VPN or IP-allowlisted networks to shrink the attacker pool able to obtain the low-privilege account required by PR:L.