CVE-2026-46400: HAXCMS PHP has a File Upload Validation Bypass

Synopsis

A file upload validation bypass affects HAXCMS PHP (versions 11.0.6 through before 25.0.0). The flaw is reachable over the network and requires only a low-privilege account; the upload endpoint checks file extensions with a regex but never inspects actual file contents or MIME types, so an attacker can rename a PHP webshell to look like an image and upload it. Successful exploitation gives the attacker remote code execution on the server. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable upload endpoint is exposed over the network, so the attacker must be able to reach the service via HTTP/HTTPS from a remote host.

• AuthenticationRequired

  A low-privilege authenticated account is sufficient; no administrative rights are needed to reach the file upload functionality.

• Victim interactionNot required

  The attacker submits the malicious upload directly; no action from another user or administrator is needed.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental factors are required beyond reaching the upload endpoint with a crafted file.

Blast Radius

• Attacker gains remote code execution by uploading a PHP webshell and triggering it through the web server, running arbitrary OS commands under the web server process account.
• Attacker reads files accessible to the web server process, including application configuration files that may contain database credentials or API keys.
• Attacker modifies or deletes application files and stored content on the server, corrupting microsite data or implanting persistent backdoors.
• Attacker can crash or degrade the affected service by consuming server resources or corrupting runtime state through the uploaded payload.