CVE-2026-46390

Medium

Description

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history. Version 26.0.0 patches the issue.

SeverityMedium

CVSS6.9

Exploit probability—

ProductHaxtheweb Haxcms-php

PublishedJun 5, 2026

First seenJun 5, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Sources list no fixed version or patch link for this vulnerability.

Affected products

Product	Affected versions	Fixed in
haxtheweb haxcms-php	>= 2.0.0, < 26.0.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.