GHSA-q862-gcgq-5m6gPublished

HAXcms createSite SSRF Enables Arbitrary File Read

Exploitation and risk

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

Which CVEs have scores here?

This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

cve-program · CVE-2026-46393

Published

HAX CMS helps manage microsite universe with PHP or NodeJs backends. An authenticated Server-Side Request Forgery (SSRF) vulnerability in versions prior to 26.0.0 allows authenticated users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and internal network access. Version 26.0.0 contains a fix.

Source published: 5 Jun 2026 18:24:49 UTC
Source modified: 8 Jun 2026 16:08:41 UTC
Saved here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

euvd · EUVD-2026-34884

Published

Additional publisher context

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Jun 5, 2026, 6:24:49 PM

dateUpdated: Jun 8, 2026, 4:08:41 PM

Source published: Jun 5, 2026, 6:24:49 PM (timezone not stated)
Source modified: Jun 8, 2026, 4:08:41 PM (timezone not stated)
Saved here: 13 Nov 2026 13:05:41 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 4.0 · 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

nvd · CVE-2026-46393

Published

Additional publisher context

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-918

Original publisher date fields

published: 2026-06-05T19:16:33.303

lastModified: 2026-06-17T10:53:37.967

Source published: 5 Jun 2026 19:16:33 UTC
Source modified: 17 Jun 2026 10:53:37 UTC
Saved here: 25 Oct 2026 12:17:14 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · [email protected] · Secondary · 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

osv · GHSA-q862-gcgq-5m6g

Published

### Summary An authenticated Server-Side Request Forgery (SSRF) vulnerability in HAXcms allows users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and internal network access. ### Details The `createSite` endpoint in HAXcms (v11.0.6) accepts a `build.files` parameter that allows an authenticated user to supply arbitrary URLs or local file paths. This input is processed without validation and ultimately fetched server-side using `file_get_contents()`. The data flow is as follows: - User input (`build.files`) is processed via `object_to_array()` into a PHP array - Assigned to `$filesToDownload` in `Operations.php` (line 2626) - Iterated over in `Operations.php` (line 2730), where each entry is passed to `HAXCMSFile::save()` with bulk-import enabled In `HAXCMSFile.php` (line 30), the following occurs: ```php file_get_contents($upload['tmp_name']); ``` Here, tmp_name is attacker-controlled and may contain: - External URLs (`http://attacker.com`) - Internal services (`http://127.0.0.1`) - Cloud metadata endpoints (`http://169.254.169.254`) - Local file paths (`/etc/passwd`, `/proc/self/environ`) The bulk-import flag bypasses `is_uploaded_file()` validation, which normally ensures the file originates from a legitimate upload. The only restriction is an extension whitelist based on the filename (array key), which is fully attacker-controlled. There are no restrictions on: - URL schemes (`http`, `file`, `gopher`, etc.) - Destination IP ranges (internal, loopback, metadata services) - Response content All fetched content is written to: ``` sites/<sitename>/files/<filename> ``` and is accessible via the web. ### PoC Prerequisites: - Authenticated session (default credentials: `admin/admin` on fresh installs) - Valid JWT and CSRF token Step 1: Log in and capture JWT + CSRF token Step 2: Send crafted request: ``` POST /createSite HTTP/1.1 Host: target Authorization: Bearer [JWT] X-CSRF-Token: [TOKEN] Content-Type: application/json { "site": { "name": "poc" }, "build": { "files": { "poc.txt": { "tmp_name": "http://169.254.169.254/latest/meta-data/iam/security-credentials/" } } } } ``` Step 3: Retrieve response: ``` GET /sites/poc/files/poc.txt ``` The response will contain the fetched content (e.g., cloud credentials or internal service data). ### Impact - SSRF enabling access to internal network services - Arbitrary file read via local filesystem paths - Cloud credential exposure through metadata endpoints - Data exfiltration via web-accessible file storage Any authenticated user can exploit this to access sensitive server or infrastructure data, potentially leading to full system or cloud environment compromise.

Source published: 19 May 2026 14:44:20 UTC
Source modified: 10 Sep 2026 03:50:55 UTC
Saved here: 24 Oct 2026 13:17:17 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Publisher rating · HIGH