CVE-2026-22704: HAX CMS Stored XSS Vulnerability

CVE-2026-22704 Overview

CVE-2026-22704 is a stored Cross-Site Scripting (XSS) vulnerability affecting HAX CMS, a content management system designed to manage microsite universes with PHP or NodeJs backends. The vulnerability exists in versions 11.0.6 through 24.x.x and allows attackers to inject malicious scripts that persist in the application, potentially leading to complete account takeover.

Critical Impact

This stored XSS vulnerability can be exploited to hijack user sessions and take over administrator accounts, granting attackers full control over the affected HAX CMS installation.

Affected Products

• HAX CMS versions 11.0.6 to before 25.0.0
• HAX CMS NodeJs backend
• HAX CMS PHP backend

Discovery Timeline

• January 10, 2026 - CVE-2026-22704 published to NVD
• January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22704

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) in HAX CMS allows authenticated attackers with low privileges to inject malicious HTML or JavaScript code that gets stored on the server and executed in the browsers of other users who view the affected content. The attack requires user interaction, as a victim must navigate to a page containing the malicious payload.

The vulnerability has a changed scope, meaning that exploitation can affect resources beyond the vulnerable component itself. When successfully exploited, an attacker can achieve high impact on confidentiality, integrity, and availability of the target system, ultimately leading to full account takeover of other users including administrators.

Root Cause

The root cause of this vulnerability is improper input sanitization and output encoding of user-supplied content, combined with the ability to upload and serve HTML files directly from the application's files directories. When HTML files are served with their native content type rather than being forced as downloads, any embedded JavaScript executes in the context of the application's origin.

Attack Vector

The attack is network-based and requires an authenticated attacker with low privileges to upload a malicious HTML file to the sites' files directories. When another user (such as an administrator) navigates to or is tricked into visiting the uploaded HTML file, the malicious script executes with full access to the victim's session, cookies, and the DOM of the HAX CMS application.

The attacker can leverage this to steal session tokens, perform actions as the victim, or redirect users to phishing pages. The changed scope indicates the XSS can affect the broader application context beyond just the file serving component.

// Security patch from src/app.js - forces HTML file downloads to prevent XSS
 app.use(express.urlencoded({limit: '50mb',  extended: false, parameterLimit: 50000 }));
 app.use(helmet(helmetPolicies));
 app.use(cookieParser());

+// Security: Force download of HTML files in sites' files directories to prevent XSS
+app.use((req, res, next) => {
+  if (req.url.includes('/files/') && /\.html?$/i.test(req.url.split('?')[0])) {
+    res.setHeader('Content-Disposition', 'attachment');
+  }
+  next();
+});
 //pre-flight requests
 app.options('*', function(req, res, next) {
 	res.sendStatus(200);

Source: GitHub Commit

Detection Methods for CVE-2026-22704

Indicators of Compromise

• Unexpected HTML files uploaded to /files/ directories within HAX CMS sites
• HTML files containing <script> tags, event handlers (e.g., onerror, onload), or suspicious JavaScript code
• Access logs showing requests to HTML files in files directories followed by unusual API calls or session changes
• Reports of users being redirected to external sites or experiencing unexpected behavior

Detection Strategies

• Implement file upload monitoring to flag HTML/HTM files uploaded to sites' files directories
• Deploy Web Application Firewall (WAF) rules to detect common XSS payloads in file uploads
• Monitor application logs for suspicious access patterns to uploaded HTML files
• Use Content Security Policy (CSP) violation reporting to detect script execution attempts

Monitoring Recommendations

• Enable detailed logging for file upload operations and track HTML file uploads specifically
• Set up alerts for new HTML files appearing in the /files/ directories
• Monitor for unusual session activity that may indicate session hijacking following XSS exploitation
• Implement real-time analysis of uploaded file contents for malicious script patterns

How to Mitigate CVE-2026-22704

Immediate Actions Required

• Upgrade HAX CMS to version 25.0.0 or later immediately
• Audit existing uploaded files in /files/ directories for malicious HTML content
• Consider removing or quarantining existing HTML files in sites' files directories pending review
• Force all active user sessions to re-authenticate after applying the patch

Patch Information

The vulnerability has been addressed in HAX CMS version 25.0.0. The fix implements middleware that forces the download of HTML files when accessed from sites' files directories by setting the Content-Disposition: attachment header. This prevents browsers from rendering the HTML content inline, effectively neutralizing the XSS attack vector.

For detailed patch information, refer to the GitHub Security Advisory GHSA-3fm2-xfq7-7778 and the v25.0.0 release notes.

Workarounds

• Implement server-level configuration to force Content-Disposition: attachment headers for HTML files in /files/ directories
• Block HTML file uploads entirely through application configuration if not required for business operations
• Configure a Web Application Firewall to strip or neutralize script content from uploaded HTML files
• Apply strict Content Security Policy headers to limit script execution sources

# Nginx configuration to force download of HTML files in files directories
location ~* /files/.*\.html?$ {
    add_header Content-Disposition "attachment" always;
}