CVE-2025-32028 | HAX CMS PHP allows you to manage your microsite universe wit… | CVSS 10.0 CRITICAL

Description

HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ function in ’HAXCMSFile.php’. This save function uses a denylist to block specific file types from being uploaded to the server. This list is non-exhaustive and only blocks ’.php’, ’.sh’, ’.js’, and ’.css’ files. The existing logic causes the system to "fail open" rather than "fail closed." This vulnerability is fixed in 10.0.3.

Metadata

CVE ID: CVE-2025-32028
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2025-04-01 21:57 UTC
Published: 2025-04-08 16:06 UTC
Last updated: 2025-04-08 20:00 UTC
Primary CWE: CWE-434
CWE-434: Unrestricted Upload of File with Dangerous Type
Vendor / Product: haxtheweb / issues
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
haxtheweb	issues	—	>= 9.0.0, < 10.0.3

Weakness (CWE)

CWE	Source	Description
CWE-434	cna	CWE-434: Unrestricted Upload of File with Dangerous Type

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (1)

https://github.com/haxtheweb/issues/security/advisories/GHSA-vj5q-3jv2-cg5p https://github.com/haxtheweb/issues/security/advisories/GHSA-vj5q-3jv2-cg5p