VYPR
← All advisories
High severity8.7NVD Advisory· Published Jun 5, 2026· Updated Jun 5, 2026

CVE-2026-46392

CVE-2026-46392

Description

HAX CMS PHP allows stored XSS by uploading HTML files with uppercase extensions, bypassing a previous security fix.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

HAX CMS PHP allows stored XSS by uploading HTML files with uppercase extensions, bypassing a previous security fix.

Vulnerability

Prior to version 26.0.0, HAX CMS PHP's saveFile endpoint accepted HTML uploads with case-insensitive extensions but wrote filenames verbatim. The .htaccess rule intended to force HTML files to download was case-sensitive, failing to apply to uppercase extensions like .HTML or .Html [1].

Exploitation

An attacker can upload an HTML file with an uppercase extension (e.g., poc.HTML). When an authenticated HAX CMS user opens this file, the browser renders it inline instead of forcing a download. This allows embedded JavaScript to execute within the HAX CMS origin, bypassing the intended security mitigation [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the HAX CMS origin. This can lead to the theft of user JWTs, API tokens, enumeration of owned sites, and exfiltration of sensitive data to an attacker-controlled endpoint [1].

Mitigation

HAX CMS PHP version 26.0.0, released on 2026-05-29, addresses this vulnerability by normalizing uploaded file extensions to lowercase. Users should update to version 26.0.0 or later. No workarounds are available other than updating [1].

References
  1. Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation

AI Insight generated on Jun 5, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

2

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"A case-sensitivity mismatch between file upload validation and a server-side rule for forcing downloads allows malicious HTML files to be rendered inline."

Attack vector

An attacker can upload an HTML file with an uppercase extension (e.g., `.HTML`) to the HAX CMS. The `saveFile` endpoint validates extensions case-insensitively, allowing the upload. However, the `.htaccess` rule that forces a `Content-Disposition: attachment` header for HTML files is case-sensitive and does not match uppercase extensions. This causes the browser to render the HTML file inline, executing any embedded JavaScript within the HAX CMS origin context [ref_id=1]. This bypasses a previous mitigation for CVE-2026-22704 [ref_id=1].

Affected code

The vulnerability lies in the `saveFile` endpoint's handling of file uploads and the `.htaccess` configuration. Specifically, the PHP validation in HAXCMSFile.php uses a case-insensitive regex for extension matching, while the `.htaccess` rule uses `SetEnvIf` which is case-sensitive by default [ref_id=1].

What the fix does

Version 26.0.0 normalizes uploaded file extensions to lowercase. This ensures that the `.htaccess` rule, which is case-sensitive, consistently matches all uploaded HTML files, regardless of their original casing. By forcing the `Content-Disposition: attachment` header for all valid HTML uploads, the vulnerability that allowed inline rendering and script execution is resolved [ref_id=1].

Preconditions

  • authThe attacker must be an authenticated user with permission to upload files.
  • inputThe attacker must craft an HTML file with an uppercase extension (e.g., .HTML).

Reproduction

1. Log in to a HAXcms deployment. 2. Create or open a site and upload `poc.HTML` through the HAX editor's media/add button. The upload will succeed due to case-insensitive validation. 3. Visit the uploaded file at `https://TARGET/_sites/SITENAME/files/poc.HTML`. The page renders inline, and the embedded script executes, exfiltrating data to a webhook. 4. Send the link to another authenticated user. When they open it, the exploit chain fires using their session cookies, compromising their account and sites [ref_id=1].

Generated on Jun 5, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

1

News mentions

1