CVE-2026-46392

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the `saveFile` endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the `.htaccess` rule that forces `Content-Disposition: attachment` on HTML files is case-sensitive. An HTML file uploaded with an uppercase extension (`.HTML`, `.Html`, `.HTM`) is still served as `text/html` but the forced-download header never applies, so the browser renders it inline and executes any embedded JavaScript in the HAXcms origin. This bypasses the mitigation shipped for CVE-2026-22704. Version 26.0.0 contains a fix.

• CWE-178
• CWE-434

• https://github.com/haxtheweb/issues/security/advisories/GHSA-hg33-w4j2-95qp
• https://github.com/haxtheweb/issues/security/advisories/GHSA-hg33-w4j2-95qp

Published

Jun 5, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46386OpenProject is open-source, web-based project management sof…9.9
• CVE-2026-46388osquery is a SQL powered operating system instrumentation, m…4.4
• CVE-2026-46389UDS Identity Config builds the Keycloak configuration image …9.8
• CVE-2026-4639Vitals ESP developed by Galaxy Software Services has a Incor…8.8
• CVE-2026-46390HAX CMS helps manage microsite universe with PHP or NodeJs b…6.9
• CVE-2026-46391HAX CMS helps manage microsite universe with PHP or NodeJs b…8.7
• CVE-2026-46393HAX CMS helps manage microsite universe with PHP or NodeJs b…7.1
• CVE-2026-46394HAX CMS helps manage microsite universe with PHP or NodeJs b…7.7
• CVE-2026-46395HAX CMS helps manage microsite universe with PHP or NodeJs b…9.3
• CVE-2026-46396HAX CMS helps manage microsite universe with PHP or NodeJs b…9.3
• CVE-2026-46397HAX CMS helps manage microsite universe with PHP or NodeJs b…6.5
• CVE-2026-46398HAX CMS helps manage microsite universe with PHP or NodeJs b…8.8