CVE-2026-46397: HAX CMS Path Traversal Vulnerability

CVE-2026-46397 Overview

CVE-2026-46397 is an authenticated Local File Inclusion (LFI) vulnerability in HAX CMS, a content management system that manages microsite environments using PHP or Node.js backends. The flaw resides in the saveOutline endpoint, where a low-privileged authenticated user can manipulate the location field written into site.json to traverse directories and read arbitrary files on the server. Attackers can exfiltrate sensitive files accessible to the web server user (www-data), including /etc/passwd, application secrets, and configuration files. HAX CMS version 26.0.0 patches the vulnerability. The weakness is classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated low-privileged users can read arbitrary files readable by the www-data account, exposing credentials, configuration, and system files used to escalate further attacks.

Affected Products

HAX CMS (PHP backend) prior to version 26.0.0
HAX CMS (Node.js backend) prior to version 26.0.0
HAXcms saveOutline endpoint handling site.json writes

Discovery Timeline

2026-06-05 - CVE-2026-46397 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-46397

Vulnerability Analysis

The vulnerability exists in the HAXCMS saveOutline endpoint, which accepts user-supplied outline data and persists it to the site's site.json file. The location field in the submitted outline is written without sufficient validation or canonicalization. When HAXCMS later resolves the location value to load or render content, attacker-controlled path traversal sequences cause the application to include or return content from arbitrary filesystem paths.

Because authentication is required, exploitation is limited to users who already hold an account on the platform. However, HAX CMS deployments often grant low-privileged authoring roles, and the flaw allows those accounts to read files well beyond their authorization boundary. The exposed files frequently include database credentials, API tokens, and operating system metadata that enable lateral movement or privilege escalation.

Root Cause

The root cause is improper input validation of the location field on the saveOutline endpoint. The application accepts relative path components such as ../ and persists them into site.json without restricting paths to the intended site directory. Subsequent file resolution follows the attacker-controlled path, producing a classic path traversal into LFI condition.

Attack Vector

An authenticated attacker submits a crafted outline payload to the saveOutline endpoint. The payload sets the location field to a traversal string that points outside the intended site content directory toward sensitive targets such as /etc/passwd, .env files, or application configuration. The CMS writes the path into site.json, and on retrieval the contents of the targeted file are returned to the attacker. No user interaction is required beyond the attacker's authenticated session.

No verified public exploitation code has been released. Refer to the GitHub Security Advisory GHSA-7fr7-h4p3-jjr8 for vendor technical details.

Detection Methods for CVE-2026-46397

Indicators of Compromise

Entries in site.json files containing path traversal sequences such as ../, absolute paths, or references to system files like /etc/passwd
HTTP requests to the saveOutline endpoint with location parameters containing directory traversal characters
Unexpected reads of sensitive files by the www-data (or equivalent) web server process
Outbound transfers of configuration or secret files from HAX CMS hosts shortly after authoring activity

Detection Strategies

Inspect web server and application logs for POST requests to the HAXCMS saveOutline endpoint and flag payloads where location contains .., null bytes, or absolute paths
Audit existing site.json files across HAX CMS instances for location values that resolve outside each site's content directory
Monitor filesystem access events from the web server process for reads of /etc/passwd, /etc/shadow, .env, and other configuration files outside the application root

Monitoring Recommendations

Enable verbose request logging on the HAX CMS application tier and forward logs to a centralized analytics platform for correlation
Alert on authenticated low-privileged users issuing requests that modify outline structures with unusual location patterns
Track file integrity on site.json files and surface unauthorized or anomalous modifications

How to Mitigate CVE-2026-46397

Immediate Actions Required

Upgrade all HAX CMS instances to version 26.0.0 or later, which contains the official fix for the saveOutline LFI
Review and sanitize all existing site.json files for malicious location values introduced before patching
Rotate any credentials, API tokens, or secrets that may have been accessible to the www-data user on affected hosts
Audit user accounts and revoke unnecessary authoring privileges to reduce the pool of accounts capable of authenticated exploitation

Patch Information

HAX CMS version 26.0.0 patches CVE-2026-46397 by validating and constraining the location field written through the saveOutline endpoint. Administrators should follow the upgrade instructions in the GitHub Security Advisory GHSA-7fr7-h4p3-jjr8 and verify the application version after deployment.

Workarounds

Restrict access to the HAX CMS authoring interface to trusted networks via VPN or IP allowlisting until the patch is applied
Deploy a web application firewall rule that blocks requests to the saveOutline endpoint containing .., encoded traversal sequences, or absolute paths in the location field
Run the web server process with the least privilege required and limit filesystem read permissions for the www-data account to the application directory

bash

# Example WAF rule (ModSecurity) to block path traversal in saveOutline requests
SecRule REQUEST_URI "@contains saveOutline" \
    "id:1046397,phase:2,deny,status:403,log,\
     msg:'HAX CMS saveOutline path traversal attempt (CVE-2026-46397)',\
     chain"
  SecRule ARGS:location "@rx (\.\./|\.\.\\|%2e%2e%2f|^/)" \
    "t:none,t:urlDecodeUni,t:lowercase"