CVE-2026-48527

Vulnerability

HAX CMS versions up to and including 26.0.0 are affected by a stored cross-site scripting (XSS) vulnerability in the /system/api/saveNode endpoint [2][3]. The issue stems from a regex-based HTML sanitizer that expects whitespace before event handler attributes (e.g., onclick, onload). When an attacker removes this whitespace—such as click me—the sanitizer fails to remove the event handler, but browsers still parse it as a valid attribute, leading to script execution [2][3]. Only authenticated users with page editing permissions can exploit this flaw [2][3]. Affected parameter: node.body in POST requests [2][3].

Exploitation

An attacker must have an authenticated HAX CMS session with permission to edit pages [2][3]. Using a tool like Burp Suite, the attacker captures the page save request to /system/api/saveNode?site_token=[VALID_SITE_TOKEN] and modifies the node.body value in the JSON body to include a crafted payload such as click me [2][3]. The sanitizer bypass occurs because the regex expects a space before the attribute name, which is omitted [2][3]. The payload is stored in the generated page files (e.g., index.html) and executes when any user clicks the injected link [2][3].

Impact

When a victim clicks the injected element, the attacker-controlled JavaScript runs in the victim's browser within the context of the HAX CMS site [2][3]. This can lead to theft of sensitive browser-accessible data, including localStorage.jwt and window.appSettings—which contain API paths and tokens available to the authenticated user [2][3]. Consequently, an attacker may be able to perform actions on behalf of the victim, such as modifying pages, reading protected content, or escalating privileges [2][3].

Mitigation

Patches are available: @haxtheweb/haxcms-nodejs version 26.0.1 and haxcms-php version 26.0.2 [2][3]. Users should upgrade to these versions immediately. If upgrading is not possible, administrators should restrict edit permissions to only trusted users and review custom sanitization logic for similar bypass patterns. No workaround that completely mitigates the risk without patching has been disclosed [2][3].