Local File Inclusion Vulnerability in HAX CMS PHP

CVE-2025-49138

What is CVE-2025-49138?

HAX CMS PHP has a Local File Inclusion (LFI) vulnerability in its saveOutline endpoint affecting versions prior to 11.0.0. This flaw allows authenticated low-privileged users to exploit the system by manipulating the location field in site.json. Without proper validation or sanitization, the backend saves the user-provided input directly, enabling attackers to read sensitive files, such as application secrets and system configuration files. Such vulnerabilities pose significant security risks, exposing sensitive information stored within the server.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References