CVE-2025-32028
HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution
HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ function in ’HAXCMSFile.php’. This save function uses a denylist to block specific file types from being uploaded to the server. This list is non-exhaustive and only blocks ’.php’, ’.sh’, ’.js’, and ’.css’ files. The existing logic causes the system to "fail open" rather than "fail closed." This vulnerability is fixed in 10.0.3.
Reserved 2025-04-01 | Published 2025-04-08 | Updated 2025-04-08 | Assigner GitHub_MCWE-434: Unrestricted Upload of File with Dangerous Type
github.com/...issues/security/advisories/GHSA-vj5q-3jv2-cg5p
Support options
