CVE-2026-46392: HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation

Synopsis

Stored cross-site scripting (XSS) affects HAX CMS PHP prior to version 26.0.0. The vulnerability is reachable over the network and requires a low-privilege authenticated account; it also requires a victim to visit or load the uploaded file in their browser. By uploading an HTML file with an uppercase extension (.HTML, .HTM, .Html), an attacker bypasses the case-sensitive .htaccess forced-download rule, causing the browser to render the file inline and execute any embedded JavaScript within the HAXcms origin, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The saveFile endpoint is exposed over the network, so the attacker must be able to reach the HAX CMS PHP service via HTTP/HTTPS from a remote network location.

• AuthenticationRequired

  The attacker must hold at least a low-privilege authenticated account on the HAX CMS instance to reach the saveFile upload endpoint.

• Victim interactionRequired

  A victim (such as another authenticated user or admin) must open or load the uploaded HTML file in their browser for the embedded JavaScript to execute within the HAXcms origin.

• Attack complexityDetail

  Attack complexity is low: no race conditions or special environmental factors are required; uploading a file with an uppercase HTML extension reliably bypasses the forced-download mitigation every time.

Blast Radius

• Attacker-controlled JavaScript executes in the HAXcms origin, allowing the attacker to read session tokens and authentication cookies belonging to the victim.
• Captured session material can be used to impersonate the victim and perform any action the victim's account is authorized to take, including modifying or deleting content.
• The attack is stored (persisted on the server as an uploaded file), so any user who browses to the malicious URL after the upload is affected without further attacker interaction.