8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22704

CVE-2026-22704: HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover

HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22704

CVE-2026-22704:

8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@haxtheweb/haxcms-nodejs	npm	>= 11.0.6, < 25.0.0	25.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in HAXcms. The root cause is the saveFile function, which allows authenticated users to upload arbitrary files, including HTML files containing malicious JavaScript. The application fails to prevent these uploaded HTML files from being rendered directly in a user's browser.

The exploit unfolds in two stages:

Storing the Payload: The attacker uploads an HTML file containing a malicious script using the /system/api/saveFile endpoint, which is handled by the saveFile function.
Executing the Payload: A victim (typically an administrator) is tricked into navigating to the URL of the uploaded file. The browser renders the HTML and executes the script.

The script in the provided PoC targets the /system/api/refreshAccessToken endpoint. When executed with the administrator's session cookies, the refreshAccessToken function returns a new JWT, which the script then exfiltrates to an attacker-controlled server, leading to account takeover.

The patch mitigates the vulnerability not by changing the saveFile or refreshAccessToken functions, but by introducing a new middleware in src/app.js. This middleware intercepts requests for HTML files within the /files/ directory and adds a Content-Disposition: attachment header, forcing the browser to download the file instead of rendering it, thus preventing the XSS from executing.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.