CVE-2026-46397: Authenticated Local File Inclusion in HAX CMS (MEDIUM)

Technical summary

CVE-2026-46397 is an authenticated local file inclusion vulnerability in HAX CMS versions prior to 26.0.0. The vulnerability exists in the saveOutline endpoint, where insufficient input validation on the location field allows an authenticated attacker to traverse the filesystem and read arbitrary files. By crafting malicious payloads in the location parameter that is written to site.json, an attacker can escape the intended directory context and access files anywhere the web server process (typically www-data) can read. This includes system configuration files, application secrets, and environment files that may contain database passwords or API credentials. The vulnerability requires prior authentication but does not require user interaction or elevated privileges beyond basic login access.

Business impact

Compromise of sensitive application and system files creates multiple downstream risks. Exposed credentials enable lateral movement to databases, external APIs, or internal infrastructure. Leaked configuration details may reveal application architecture, third-party service integrations, or security mechanisms. For organizations using HAX CMS to manage customer-facing microsites, this could also expose customer data if stored in accessible configuration files. The reputational and compliance impact depends on what sensitive data is readable by the web server process and how that data is handled post-breach. Organizations in regulated industries (healthcare, finance, education) face heightened notification and remediation obligations.

Affected systems

HAX CMS installations running versions prior to 26.0.0 with both PHP and NodeJs backend support are affected. The vulnerability requires that an attacker has valid authentication credentials (not necessarily admin-level) and network access to the CMS. This means the risk is primarily to organizations where user account creation is permitted or where internal staff may have been compromised. Air-gapped or strictly access-controlled deployments face lower exposure, while public-facing instances with open registration or many user accounts face higher risk.

Exploitability

Exploitability is straightforward for anyone with valid login credentials. The attack requires only HTTP requests to the saveOutline endpoint with a crafted location parameter—no complex exploitation techniques, no race conditions, no client-side tricks. An attacker does not need administrative privileges, making this accessible to any low-privileged user account. The primary barrier is obtaining initial authentication; once authenticated, file reading is reliable and does not depend on environment-specific factors like system configuration or library versions. The CVSS score of 6.5 reflects the authentication requirement and the lack of integrity or availability impact, but the confidentiality impact is marked as high because arbitrary file read access is generally considered a serious outcome.

Remediation

Immediate action: upgrade HAX CMS to version 26.0.0 or later. If immediate patching is not feasible, restrict access to the saveOutline endpoint at the network or application level to only trusted administrative users, and review access logs for suspicious manipulation of site configuration. Do not rely solely on network-level controls; patching is the definitive fix. After patching, review any site.json files that may have been modified during the vulnerability window to ensure no malicious location field injection remains.

Patch guidance

Upgrade to HAX CMS version 26.0.0 or any subsequent release. Verify the upgrade by checking the CMS version number in the admin panel or by reviewing the package.json (Node) or composer.json (PHP) manifest. Test the saveOutline endpoint after upgrade to confirm it no longer accepts path traversal sequences in the location field. If using a managed hosting provider, confirm they have released and deployed the patched version before removing your own mitigations.

Detection guidance

Monitor web server logs and CMS application logs for requests to the saveOutline endpoint that contain path traversal patterns in the location parameter, such as '../', '..\', '%2e%2e/', or encoded variants. Check for unusual file read patterns in access logs, particularly reads of /etc/passwd, configuration files, or .env files. Review site.json files for unexpected location field values that point outside the expected microsite directory. Implement application-level logging that captures the decoded location parameter value before it is processed, not just the raw HTTP request. Intrusion detection systems should be tuned to flag path traversal attempts in POST body parameters.

Why prioritize this

Although the CVSS score is medium (6.5), this vulnerability warrants prompt patching because it provides direct, unauthenticated-equivalent access to sensitive files with minimal attacker effort. The barrier is only user authentication, not special conditions or privilege escalation. Organizations should prioritize this above other medium-severity issues, especially if their HAX CMS instance supports multiple user accounts or if sensitive credentials are readable by the web server process. Delay increases the window for insider threats or compromised accounts to exploit the flaw.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects: Attack Vector (Network) and Attack Complexity (Low) which indicate ease of remote exploitation; Privileges Required (Low) because any authenticated user can exploit it; User Interaction (None) because no victim action is needed; and Scope (Unchanged) because the impact is confined to the vulnerable component. The high Confidentiality impact recognizes that arbitrary file read is a serious information disclosure. Integrity and Availability are marked as None because the vulnerability does not corrupt data or disrupt service. Organizations with sensitive data readable by the web server should consider this vulnerability more urgent than the base score alone suggests.

Frequently asked questions