PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46393 haxtheweb CVE debrief

CVE-2026-46393 is an authenticated Server-Side Request Forgery (SSRF) vulnerability in HAX CMS versions prior to 26.0.0. This vulnerability allows authenticated users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and internal network access. The vulnerability has a CVSS score of 7.1 and is classified as HIGH severity. Version 26.0.0 of HAX CMS contains a fix for this vulnerability.

Vendor
haxtheweb
Product
haxcms-nodejs
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-05
Original CVE updated
2026-06-08
Advisory published
2026-06-05
Advisory updated
2026-06-08

Who should care

Users of HAX CMS versions prior to 26.0.0 should apply the patch in version 26.0.0 to prevent exploitation of this vulnerability.

Technical summary

The vulnerability is caused by an authenticated SSRF issue in HAX CMS, which allows users to make requests to internal or local resources and write the responses to a web-accessible directory.

Defensive priority

HIGH

Recommended defensive actions

  • Apply the patch in version 26.0.0 of HAX CMS to fix the vulnerability.
  • Restrict access to the HAX CMS system to only trusted users.

Evidence notes

The CVE record for CVE-2026-46393 can be found at [cve-org]. The NVD detail for CVE-2026-46393 can be found at [nvd]. Additional information can be found in the source reference at [ref-4].

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46393 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46393

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46393 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46393

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.