CVE-2026-46394

Name of the Vulnerable Software and Affected Versions HAX CMS versions prior to 26.0.0

Description An OS command injection issue exists in the Git.php library of the PHP backend. The application executes shell command strings using the proc open() function without properly sanitizing input. An attacker capable of controlling parameters passed into Git operations can execute arbitrary OS commands with web server privileges. Of the 17 functions that invoke shell commands, only the commit() function correctly utilizes escapeshellarg(). If combined with a configuration manipulation flaw, this can result in full remote code execution and complete system compromise.

Recommendations Update to version 26.0.0.