CVE-2026-46392

Name of the Vulnerable Software and Affected Versions HAX CMS PHP versions prior to 26.0.0

Description The saveFile endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim. However, the .htaccess rule designed to force Content-Disposition: attachment on HTML files is case-sensitive. This allows an attacker to upload an HTML file using an uppercase extension such as .HTML, .Html, or .HTM. Because the forced-download header does not apply to these extensions, the browser renders the file as text/html and executes embedded JavaScript within the HAXcms origin.

Recommendations Update to version 26.0.0.