Description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an Authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data). Version 26.0.0 patches the issue.
CVSS 6.5EPSS 0.28900000000000003%Risque 0.67
Voir la source- Publication
- 2026-06-05 20:17:33
- Versions concernées
- <26.0.0
- Type
- Core software
- Dernière modification
- 2026-07-23 07:10:00
- Vecteur
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N