CVE-2025-49141 HaxCMS-PHP Command Injection Vulnerability
An authenticated attacker can execute arbitrary OS commands on the HaxCMS backend by injecting malicious input into the gitImportSite URL parameter.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-49141?
CVE-2025-49141 is a high-severity command injection vulnerability in haxtheweb issues, published on 9 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the `gitImportSite` functionality obtains a URL string from a POST request and insufficiently validates user input. The `set_remote` function later passes this input into `proc_open`, yielding OS command injection. An authenticated attacker can craft a URL string that bypasses the validation checks employed by the `filter_var` and `strpos` functions in order to execute arbitrary OS commands on the backend server. The attacker can exfiltrate command output via an HTTP request. Version 11.0.3 contains a patch for the issue.
Weakness: CWE-78
Which versions are affected by CVE-2025-49141?
2 open source packages ship an affected version, including @haxtheweb/haxcms-nodejs. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
@haxtheweb/haxcms-nodejs npm | All versions | 11.0.3 |
@haxtheweb/haxcms-nodejs npm | All versions | 11.0.3 |
Products include Psu Haxcms-Nodejs, Psu Haxcms-Php.
How do I fix CVE-2025-49141?
Upgrade @haxtheweb/haxcms-nodejs to 11.0.3 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-49141 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-49141 exists.
Other vulnerabilities in haxtheweb issues
- CVE-2025-54127 HAXcms's Insecure Default Configuration Leads to Unauthenticated Access
- CVE-2025-49137 Hax CMS Stored Cross-Site Scripting vulnerability
- CVE-2025-54378 HAX CMS Backend Lacks Comprehensive Authorization Checks
- CVE-2026-22704 HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover
- CVE-2025-54137 NodeJS version of the HAX CMS application is distributed with Default Secrets
Sources
Also known as GHSA-g4cf-pp4x-hqgw.