CVE-2026-46397

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an Authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data). Version 26.0.0 patches the issue.

• CWE-22
• CWE-73

• https://github.com/haxtheweb/issues/security/advisories/GHSA-7fr7-h4p3-jjr8
• https://github.com/haxtheweb/issues/security/advisories/GHSA-7fr7-h4p3-jjr8

Published

Jun 5, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46391HAX CMS helps manage microsite universe with PHP or NodeJs b…8.7
• CVE-2026-46392HAX CMS helps manage microsite universe with PHP or NodeJs b…8.7
• CVE-2026-46393HAX CMS helps manage microsite universe with PHP or NodeJs b…7.1
• CVE-2026-46394HAX CMS helps manage microsite universe with PHP or NodeJs b…7.7
• CVE-2026-46395HAX CMS helps manage microsite universe with PHP or NodeJs b…9.3
• CVE-2026-46396HAX CMS helps manage microsite universe with PHP or NodeJs b…9.3
• CVE-2026-46398HAX CMS helps manage microsite universe with PHP or NodeJs b…8.8
• CVE-2026-46399HAX CMS helps manage microsite universe with PHP or NodeJs b…9.4
• CVE-2026-4640Vitals ESP developed by Galaxy Software Services has a Missi…8.7
• CVE-2026-46400HAX CMS helps manage microsite universe with PHP or NodeJs b…8.7
• CVE-2026-46401HAX CMS helps manage microsite universe with PHP or NodeJs b…5.3
• CVE-2026-46402Microsoft UFO open-source framework for intelligent automati…8.1