CVE-2026-46399: Authenticated Remote Code Execution via File Overwrite

Severity: critical (CVSS 9.4 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-05 · updated 2026-06-17
Weakness: CWE-15

Description

HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Git filter commands and achieve code execution on the HAX CMS server. Version 26.0.0 patches the issue.

Affected products

haxtheweb haxcms-nodejs: before 26.0.0
haxtheweb haxcms-php: before 26.0.0

References

https://github.com/haxtheweb/issues/security/advisories/GHSA-q759-vxg8-vq5j
https://github.com/haxtheweb/issues/security/advisories/GHSA-q759-vxg8-vq5j

Get alerted when CVE-2026-46399 or the next vulnerability affects your stack