-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability (GHSA-hxrr-x32w-cg8g / CVE-2025-49138) is a Local File Inclusion in HAXCMS. It occurs in two stages:
/system/api/saveOutline endpoint. The location parameter in this request is not sanitized and is saved directly into the site.json file. The backend operation likely responsible for this is a method within Operations.php, such as saveManifest(), which handles saving the site's structure including item locations.site.json to render a page or provide data for feeds/search, functions like HAXCMSSite::getPageContent(), JSONOutlineSchemaItem::readLocation(), HAXCMSSite::jsonFeedFormat(), HAXCMSSite::lunrSearchIndex(), RSS::rssItems(), and RSS::atomItems() read the tainted location value. In vulnerable versions, these functions used the location in file_get_contents() calls without adequate sanitization, allowing a path traversal payload (e.g., ../../../etc/passwd) to be executed, thus reading arbitrary files from the server.The fixing commit 0dd3e98fe2fadd0793b667d4af2aac230980e0f8 addresses this by:
HAXCMSSite::validatePageLocation() which checks if a path is within the allowed site directory and strips ../ and ./.str_replace sanitization in all identified functions that consume the location parameter before passing it to file_get_contents().filter_var and strip_tags in various data handling functions in Operations.php and HAXCMSSite.php.Therefore, the primary vulnerable functions are those involved in saving the unsanitized path and those involved in reading files using that path.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| elmsln/haxcms | composer | < 11.0.0 | 11.0.0 |
A Semantic Attack on Google Gemini - Read the Latest Research