HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter

Vulnerability

Overview

CVE-2025-49138 describes an authenticated Local File Inclusion vulnerability in HAX CMS PHP, affecting versions prior to 11.0.0. The root cause lies in the saveOutline endpoint at /system/api/saveOutline: when a user submits a POST request, the location field is stored directly into the site's site.json file without sanitization. This unsanitized input is later used by the CMS to resolve and load content for a node, leading to path traversal attacks [1][2].

Exploitation

An attacker with a valid CMS account (lowest privilege suffices) can exploit the vulnerability by sending a crafted POST request to the saveOutline endpoint. The location parameter accepts relative paths such as ../../../etc/passwd, which are faithfully written to the site's outline. When the CMS later interprets this outline—for example, in the HAXCMSSite.php file at line 1248—it includes the attacker-specified file, rendering its contents on the server-side response [3][4].

Impact

Successful exploitation allows the attacker to read any file on the filesystem that the web server user (typically www-data) can access. This includes sensitive system files like /etc/passwd, application configuration files containing secrets or database credentials, and potentially other protected resources. The vulnerability does not require any special privileges beyond initial authentication [1][4].

Mitigation

The vulnerability was addressed in version 11.0.0. Users of HAX CMS PHP should upgrade immediately to the patched version. No workarounds have been published, and the advisory recommends applying the fix as soon as possible [1][4].