Vulnerability Description
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history. Version 26.0.0 patches the issue.
Related Weaknesses (CWE)
References
- https://github.com/haxtheweb/issues/security/advisories/GHSA-6434-8rch-w65c
- https://github.com/haxtheweb/issues/security/advisories/GHSA-6434-8rch-w65c
FAQ
What is CVE-2026-46390?
CVE-2026-46390 is a documented vulnerability. HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated users, allowing unauthentic...
How severe is CVE-2026-46390?
CVSS scoring is not yet available for CVE-2026-46390. Check NVD for updates.
Is there a patch for CVE-2026-46390?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.