CVE-2026-46394: HAX CMS Vulnerable to Command Injection using Git.php

Synopsis

An OS command injection vulnerability exists in the Git.php library of the HAX CMS PHP backend (haxcms-php versions before 26.0.0). The application builds shell command strings from unsanitized user-supplied input and executes them via proc_open(); an attacker reachable over the network with a low-privilege account can inject arbitrary OS commands. Successful exploitation gives the attacker full code execution and system control with the privileges of the web server process. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP requests to the HAX CMS PHP backend to supply malicious input to Git operations.

• AuthenticationRequired

  A low-privilege authenticated account is sufficient; the attacker does not need admin credentials, but unauthenticated access alone is not enough to reach the vulnerable code paths.

• Victim interactionNot required

  No victim action is needed; the attacker sends crafted requests directly to the server without any user having to click a link or open a file.

• Attack complexityDetail

  Exploitation has elevated complexity because it depends on specific target conditions, including chaining with a separate configuration-manipulation vulnerability to achieve full remote code execution; the exploit is not universally reliable on every HAX CMS deployment.

Blast Radius

• Executes arbitrary OS commands under the web server's process privileges, giving the attacker a foothold on the underlying host.
• Reads files, credentials, and secrets accessible to the web server user, including database connection strings and API keys stored on disk.
• Writes or overwrites files on the host, enabling the attacker to plant backdoors, modify application code, or corrupt site content.
• In combination with the referenced configuration-manipulation vulnerability, achieves complete system compromise of the affected server.