HAX CMS EUVD-2026-34902

Exploitation requires a valid authenticated session with at least low-privileged access (CVSS PR:L confirmed) to a HAX CMS instance running a version prior to 26.0.0. The attacker must have permission to invoke the saveOutline endpoint, which is part of the normal content editing workflow - meaning any user account with outline-editing capability is sufficient. No special server-side configuration is required beyond a default HAX CMS deployment. What limits exploitation: unauthenticated attackers cannot exploit this; an attacker must first obtain credentials or have a legitimate account. Exploitation is constrained to file read operations only (S:U/C:H/I:N/A:N) - no write capability or code execution is directly achievable through this vector alone.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately characterizes this as a medium-severity but high-confidentiality-impact issue. The network attack vector and low attack complexity mean exploitation is straightforward once the attacker has any authenticated session - no special tooling or chaining is required. The requirement for at least low-privileged authentication (PR:L) is the primary limiting factor, preventing unauthenticated mass exploitation. No EPSS score was provided in the source data, so exploitation probability cannot be quantified against the broader vulnerability population. The vulnerability is not in the CISA KEV catalog and no public proof-of-concept code has been identified at time of analysis. Real-world risk is moderate: an insider, a compromised low-privilege account, or any application that grants guest/editor-level access is sufficient for exploitation. The High confidentiality impact is meaningful - application secrets and system credentials accessible to www-data could facilitate lateral movement or privilege escalation beyond the initial LFI.

An attacker with any authenticated low-privileged account - such as an editor or contributor role - sends a crafted POST request to the saveOutline endpoint with a manipulated location field containing a path traversal payload (e.g., ../../../../etc/passwd). HAX CMS writes this value into site.json and subsequently reads the resolved path, returning the contents of the targeted system file to the attacker. No public proof-of-concept has been identified at time of analysis, but the attack is straightforward given the low complexity rating in the CVSS vector.