Local File Inclusion (LFI)

elmsln/haxcms is vulnerable to Local File Inclusion LFI. The vulnerability is due to improper input validation in the saveOutline endpoint, allowing low-privileged authenticated users to manipulate the location field in site.json and access arbitrary files on the server...

@haxtheweb/create (>=0.1.3, <=11.0.2), @haxtheweb/open-apis (11.0.2) potentially affected by CVE-2025-49141 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=10.0.6)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2 - @haxtheweb/open-apis 11.0.2 Source cves: CVE-2025-49141 Source advisory: MEND:CVE-2025-49141...

HaxCMS-PHP Command Injection Vulnerability

Summary The 'gitImportSite' functionality obtains a URL string from a POST request and insufficiently validates user input. The ’setremote’ function later passes this input into ’procopen’, yielding OS command injection. Details The vulnerability exists in the logic of the ’gitImportSite’ functio...

GHSA-G4CF-PP4X-HQGW HaxCMS-PHP Command Injection Vulnerability

Summary The 'gitImportSite' functionality obtains a URL string from a POST request and insufficiently validates user input. The ’setremote’ function later passes this input into ’procopen’, yielding OS command injection. Details The vulnerability exists in the logic of the ’gitImportSite’ functio...

External Control of File Name or Path

Overview elmsln/haxcms is a Headless CMS for managing and publishing hybrid static, web component driven sites. Affected versions of this package are vulnerable to External Control of File Name or Path via the location parameter in the saveOutline API endpoint. An attacker can read arbitrary file...