CVE-2026-46357

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire application offline, requiring a manual server restart to restore service. Version 26.0.0 fixes the issue.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp
https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-05 20:17

Updated : 2026-07-23 07:10

NVD link : CVE-2026-46357

Mitre link : CVE-2026-46357

CVE.ORG link : CVE-2026-46357

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-46357", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46357", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T14:21:36.375730Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "haxtheweb", "product": "haxcms-nodejs", "versions": [{"status": "affected", "version": "< 26.0.0"}]}]}], "published": "2026-06-05T20:17:33.190", "references": [{"url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp", "source": "security-advisories@github.com"}, {"url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire application offline, requiring a manual server restart to restore service. Version 26.0.0 fixes the issue."}, {"lang": "es", "value": "HAX CMS ayuda a gestionar el universo de micrositios con backends de PHP o NodeJs. Antes de la versi\u00f3n 26.0.0, la aplicaci\u00f3n NodeJS de HAX CMS se bloquea cuando un atacante autenticado env\u00eda una solicitud de creaci\u00f3n de sitio especialmente dise\u00f1ada al endpoint createSite. Una sola solicitud es suficiente para dejar toda la aplicaci\u00f3n fuera de l\u00ednea, requiriendo un reinicio manual del servidor para restaurar el servicio. La versi\u00f3n 26.0.0 soluciona el problema."}], "lastModified": "2026-07-23T07:10:00.113", "sourceIdentifier": "security-advisories@github.com"}