Vulnerability Description
HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL parameters. This vulnerability affects the listFiles and saveFiles endpoints. This vulnerability exists because the application does not properly handle exceptions which occur as a result of changes to user-modifiable URL parameters. This is fixed in version 11.0.9.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Psu | Haxcms-Nodejs | < 11.0.9 |
Related Weaknesses (CWE)
References
- https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/routes/listFiles.js#L22Product
- https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/routes/saveFile.js#L52Product
- https://github.com/haxtheweb/haxcms-nodejs/commit/e9773d1996233f9bafb06832b8220ePatch
- https://github.com/haxtheweb/issues/security/advisories/GHSA-pjj3-j5j6-qj27Third Party Advisory
FAQ
What is CVE-2025-54134?
CVE-2025-54134 is a vulnerability with a CVSS score of 6.5 (MEDIUM). HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an AP...
How severe is CVE-2025-54134?
CVE-2025-54134 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-54134?
Check the references section above for vendor advisories and patch information. Affected products include: Psu Haxcms-Nodejs.