CVE-2026-46393 HAXcms createSite SSRF Enables Arbitrary File Read
Authenticated attackers can exploit SSRF in HAX CMS to read arbitrary files and access internal networks by writing responses to web-accessible directories.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46393?
CVE-2026-46393 is a high-severity server-side request forgery vulnerability in haxtheweb haxcms-nodejs, published on 5 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. An authenticated Server-Side Request Forgery (SSRF) vulnerability in versions prior to 26.0.0 allows authenticated users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and internal network access. Version 26.0.0 contains a fix.
Weakness: CWE-918
Which versions are affected by CVE-2026-46393?
2 open source packages ship an affected version, including @haxtheweb/haxcms-nodejs.
| Package | Affected | Fixed in |
|---|---|---|
@haxtheweb/haxcms-nodejs npm | All versions | 26.0.0 |
@haxtheweb/haxcms-nodejs npm | All versions | 26.0.0 |
How do I fix CVE-2026-46393?
Upgrade @haxtheweb/haxcms-nodejs to 26.0.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-46393 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-46393 exists.
Sources
Also known as GHSA-q862-gcgq-5m6g.