Critical severity9.9NVD Advisory· Published Apr 8, 2025· Updated Jun 17, 2026

CVE-2025-32028

Description

HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ function in ’HAXCMSFile.php’. This save function uses a denylist to block specific file types from being uploaded to the server. This list is non-exhaustive and only blocks ’.php’, ’.sh’, ’.js’, and ’.css’ files. The existing logic causes the system to "fail open" rather than "fail closed." This vulnerability is fixed in 10.0.3.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Psu/Haxcms PHP
cpe:2.3:a:psu:haxcms-php:*:*:*:*:*:*:*:*
Range: >=9.0.0,<10.0.3
Haxtheweb/Haxcmsllm-create
Range: >=10.0.3
Haxtheweb/issuescpe-rescue
Range: >= 9.0.0, < 10.0.3

Patches

Vulnerability mechanics

References

github.com/haxtheweb/issues/security/advisories/GHSA-vj5q-3jv2-cg5pnvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.643
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000