Executive Summary

CVE-2026-46397 is an Authenticated Local File Inclusion (LFI) vulnerability in HAXCMS versions 25.0.0 and below. It exists in the saveOutline API endpoint, where a low-privileged authenticated user can manipulate the location parameter to perform path traversal attacks. By injecting sequences like '../../' into the location field of site.json, the attacker can read arbitrary files on the server.

The vulnerability allows access to sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server user (www-data). The original mitigation was insufficient because certain inputs could bypass it. This issue was patched in version 26.0.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker with low-level authenticated access to read sensitive files on your server. This can lead to the exposure of critical information such as system user details (/etc/passwd), application secrets, and configuration files.

Such unauthorized access to sensitive data can compromise the confidentiality of your system and potentially aid further attacks or unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for unauthorized or suspicious manipulation of the location parameter in the saveOutline API endpoint of HAXCMS. Specifically, look for path traversal sequences such as '../../' or bypass attempts like '.....///.....///' in the location field of site.json.

To detect exploitation attempts, you can monitor web server logs for requests to the saveOutline endpoint containing suspicious path traversal patterns.

Example commands to search for such attempts in logs might include:

• grep -E "saveOutline.*(\.\./|\.\.\\)" /var/log/apache2/access.log
• grep -E "saveOutline.*(\.{5}///)" /var/log/apache2/access.log

Additionally, reviewing the contents of site.json files for unexpected or suspicious location values can help identify exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade HAXCMS to version 26.0.0 or later, where this vulnerability has been patched.

Until the upgrade can be applied, restrict access to the saveOutline API endpoint to trusted users only, and monitor for suspicious activity involving path traversal sequences in the location parameter.

Implement additional input validation and sanitization on the location field to prevent path traversal attacks, as the original mitigation using str_replace was insufficient.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated low-privileged users to read arbitrary files on the server, including sensitive system files, application secrets, and configuration files. This unauthorized access to sensitive data can lead to confidentiality breaches.

Such breaches of confidentiality may impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive personal and health information. Exposure of sensitive data due to this vulnerability could result in violations of these regulations.

Useful 0 Not Useful 0