CVE-2026-46390

6.9 Moyenne

Publiée le 05/06/2026 à 21:16 · Modifiée le 17/06/2026 à 12:53 · Analyse NVD reportée · Source : security-advisories@github.com

Description

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history. Version 26.0.0 patches the issue.

Traduire en français

Produits concernés

haxtheweb haxcms-php

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.9 Moyenne	security-advisories@github.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-639

Références

https://github.com/haxtheweb/issues/security/advisories/GHSA-6434-8rch-w65c
https://github.com/haxtheweb/issues/security/advisories/GHSA-6434-8rch-w65c

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories