Local File Inclusion Vulnerability in HAX CMS PHP
CVE-2025-49138

6.5MEDIUM

Key Information:

Vendor

Haxtheweb

Status
Issues
Vendor
CVE Published:
9 June 2025

What is CVE-2025-49138?

HAX CMS PHP has a Local File Inclusion (LFI) vulnerability in its saveOutline endpoint affecting versions prior to 11.0.0. This flaw allows authenticated low-privileged users to exploit the system by manipulating the location field in site.json. Without proper validation or sanitization, the backend saves the user-provided input directly, enabling attackers to read sensitive files, such as application secrets and system configuration files. Such vulnerabilities pose significant security risks, exposing sensitive information stored within the server.

Affected Version(s)

issues < 11.0.0

References

https://github.com/haxtheweb/issues/security/advisories/G...
x_refsource_CONFIRM
https://github.com/haxtheweb/haxcms-php/blob/b158d8ba1f96...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-49138 : Local File Inclusion Vulnerability in HAX CMS PHP