CVE-2026-48527: HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint

Synopsis

Stored cross-site scripting in HaxCMS lets an authenticated editor bypass the HTML sanitizer in the /system/api/saveNode endpoint by omitting whitespace before an event handler attribute. Exploitation requires a low-privilege account with page-edit permission and a victim who views the poisoned page, after which attacker-supplied JavaScript runs in the victim's browser session with full read and write access to their HaxCMS context. Patched-image rebuilds at haxcms-nodejs 26.0.1 and haxcms-php 26.0.2 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the HaxCMS saveNode endpoint over the network, typically the same exposure surface as the CMS admin UI.

• AuthenticationRequired

  A low-privilege account with permission to edit pages is sufficient; no admin role is needed.

• Victim interactionRequired

  A separate user must load the page containing the injected event handler for the stored payload to execute.

• Attack complexityDetail

  AC:L indicates the sanitizer bypass is reliable once the malformed attribute syntax is known.

Blast Radius

• Executes attacker-controlled JavaScript in the browser of any user who views the poisoned page, under that user's HaxCMS session.
• Reads session cookies, auth tokens, and any CMS content the victim can access.
• Performs authenticated writes as the victim, including editing other pages, escalating the stored payload to additional viewers, or changing account settings exposed to their role.
• Scope change (S:C) means the impact extends beyond the CMS into other origins the victim's browser trusts, such as embedded admin tooling on the same site.