The vulnerability (GHSA-hxrr-x32w-cg8g / CVE-2025-49138) is a Local File Inclusion in HAXCMS. It occurs in two stages:

1. An authenticated user makes a POST request to the /system/api/saveOutline endpoint. The location parameter in this request is not sanitized and is saved directly into the site.json file. The backend operation likely responsible for this is a method within Operations.php, such as saveManifest(), which handles saving the site's structure including item locations.
2. When HAXCMS subsequently processes this site.json to render a page or provide data for feeds/search, functions like HAXCMSSite::getPageContent(), JSONOutlineSchemaItem::readLocation(), HAXCMSSite::jsonFeedFormat(), HAXCMSSite::lunrSearchIndex(), RSS::rssItems(), and RSS::atomItems() read the tainted location value. In vulnerable versions, these functions used the location in file_get_contents() calls without adequate sanitization, allowing a path traversal payload (e.g., ../../../etc/passwd) to be executed, thus reading arbitrary files from the server.

The fixing commit 0dd3e98fe2fadd0793b667d4af2aac230980e0f8 addresses this by:

• Introducing a new validation function HAXCMSSite::validatePageLocation() which checks if a path is within the allowed site directory and strips ../ and ./.
• Applying this validation and/or direct str_replace sanitization in all identified functions that consume the location parameter before passing it to file_get_contents().
• Adding broader input sanitization using filter_var and strip_tags in various data handling functions in Operations.php and HAXCMSSite.php.

Therefore, the primary vulnerable functions are those involved in saving the unsanitized path and those involved in reading files using that path.