CVE-2026-46393: HAXcms createSite SSRF Enables Arbitrary File Read

Synopsis

A server-side request forgery (SSRF) vulnerability in HAXcms (both the Node.js and PHP backends) allows any authenticated user to instruct the server to fetch arbitrary internal or external URLs and write the responses into a web-accessible directory. The attack is reachable over the network and requires only a low-privilege account, meaning any registered user can trigger it without additional setup. Successful exploitation gives the attacker read access to internal network resources and local files, including any content the server can reach. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the HAXcms service via HTTP or HTTPS.

• AuthenticationRequired

  A low-privilege authenticated account is sufficient; any registered user of the HAXcms instance can trigger the SSRF.

• Victim interactionNot required

  No victim interaction is needed; the attacker sends the malicious request directly to the server.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions or environmental preconditions.

Blast Radius

• Reads arbitrary files accessible to the HAXcms server process, including configuration files, credentials, and application secrets.
• Fetches resources on internal network segments that would otherwise be unreachable from the public internet, exposing internal services.
• Writes fetched content into a web-accessible directory, making exfiltrated data retrievable by the attacker over a plain HTTP request.