HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation
CVE-2026-46392

8.7HIGH

Key Information:

Vendor

Haxtheweb

Status
Haxcms-PHP
Vendor
CVE Published:
5 June 2026

What is CVE-2026-46392?

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the saveFile endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the .htaccess rule that forces Content-Disposition: attachment on HTML files is case-sensitive. An HTML file uploaded with an uppercase extension (.HTML, .Html, .HTM) is still served as text/html but the forced-download header never applies, so the browser renders it inline and executes any embedded JavaScript in the HAXcms origin. This bypasses the mitigation shipped for CVE-2026-22704. Version 26.0.0 contains a fix.

Affected Version(s)

haxcms-php < 26.0.0

References

https://github.com/haxtheweb/issues/security/advisories/G...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.