CVE-2026-46394

An attacker who can control parameters passed into Git operations can execute arbitrary OS commands with the privileges of the web server [ref_id=1]. The vulnerability originates from unsafe command construction in the Git.php library, specifically the run() method which concatenates input directly into a shell command string that is then executed via proc_open() [ref_id=1]. Because the command is passed as a single string, it is interpreted by the system shell, allowing any embedded shell metacharacters to be executed [ref_id=1]. This can be achieved by influencing configuration values, such as site.json, through other vulnerabilities like path traversal or file overwrite [ref_id=1].

The vulnerability exists in the Git.php library of the HAXcms PHP backend. The run() method within this library is responsible for constructing and executing shell commands by concatenating input directly into a command string, which is then passed to proc_open() [ref_id=1]. This method is called with parameters that can originate from configuration values, such as site.json [ref_id=1].

Version 26.0.0 patches the issue by ensuring that input used in shell commands is properly sanitized. The advisory notes that out of 17 functions invoking shell commands, only the commit() function correctly used escapeshellarg() prior to the fix [ref_id=1]. The patch presumably addresses the unsafe command construction in the Git.php library, preventing the execution of arbitrary OS commands by properly escaping or validating user-supplied input before it is incorporated into shell commands.

Create a temporary Git repository in a controlled environment and initialize it with an initial commit. Call a vulnerable function such as create_branch() with an injected payload, like: `test; echo COMMAND_INJECTION > PWNED.txt` (replace ; with & if replication environment is Windows). The application executes: `git branch test; echo COMMAND_INJECTION > PWNED.txt`, and PWNED.txt is created in the repository confirming arbitrary OS commands are executed through unsanitized input [ref_id=1].