High severity · published Jun 5, 2026
CVE-2026-46400
HAXCMS PHP has a File Upload Validation Bypass
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 11.0.6 and prior to version 25.0.0, the file upload functionality in HAXCMS PHP only validates file extensions using a regex pattern without checking the actual file content or MIME type. This allows attackers to upload malicious files (e.g., PHP webshells) disguised as legitimate image files, potentially leading to remote code execution. Version 25.0.0 contains a fix for the issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
haxcms-php · haxtheweb
>= 11.0.6, < 25.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-46400
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-46400
github.com
https://github.com/haxtheweb/issues/security/advisories/GHSA-ffxv-9qv2-v2v8
More from haxcms-php
9.4
CVE-2026-46399
Authenticated Remote Code Execution via File Overwrite
8.8
CVE-2026-46398
HAX CMS Missing Secure Flag on Cookie
8.7
CVE-2026-46511
HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack
8.7
CVE-2026-46392
HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation
8.7
CVE-2026-48527
HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint