CVE-2026-46399: Authenticated Remote Code Execution via File Overwrite

Synopsis

Authenticated remote code execution via file overwrite affects HAX CMS (both the PHP and Node.js backends) in versions prior to 26.0.0. An attacker with any valid account can reach the vulnerability over the network and configure malicious Git filter commands, which the server then executes. Successful exploitation gives the attacker full code execution on the HAX CMS server. No fix version has been published yet; HarborGuard is tracking the upstream advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the HAX CMS service via a standard network connection.

• AuthenticationRequired

  A low-privilege authenticated account is sufficient; no admin or elevated role is needed to trigger the file overwrite.

• Victim interactionNot required

  No action by any other user or administrator is required for the attacker to complete the exploit.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special environmental factors required.

Blast Radius

• Attacker executes arbitrary code directly on the HAX CMS server by injecting malicious Git filter commands.
• All data accessible to the server process is readable, including site content, configuration files, and any stored credentials or tokens.
• The attacker can modify or delete any files the server process can write to, corrupting site content or application logic.
• Downstream systems and services reachable from the compromised server are exposed to lateral movement originating from the HAX CMS host.