haxtheweb haxcms-php up to 25.x HAXcms PHP Backend Git.php proc_open os command injection

Summaryinfo

A vulnerability, which was classified as critical, was found in haxtheweb haxcms-php up to 25.x. Affected is the function proc_open of the file Git.php of the component HAXcms PHP Backend. Such manipulation leads to os command injection. This vulnerability is uniquely identified as CVE-2026-46394. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in haxtheweb haxcms-php up to 25.x. It has been rated as critical. Affected by this issue is the function proc_open of the file Git.php of the component HAXcms PHP Backend. The manipulation with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an OS command injection vulnerability exists in the Git.php library of the HAXcms PHP backend. The application constructs shell command strings using unsanitized input and executes them via proc_open(). An attacker who can control parameters passed into Git operations can execute arbitrary OS commands with the privileges of the web server. Out of 17 functions that invoke shell commands only 1 function (`commit()`) correctly uses `escapeshellarg()`. When combined with another vulnerability that allows configuration manipulation, this issue can lead to full remote code execution and complete system compromise. Version 26.0.0 patches the issue.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-46394 since 05/13/2026. The exploitation is known to be difficult. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1202.

By approaching the search of inurl:Git.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 26.0.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• haxtheweb

Name

• haxcms-php

Version

• 25.x

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion