CVE-2025-49138: Elmsln/haxcms HAX CMS Vulnerable To Local Vulnerability
MODERATECVE-2025-49138 is a MODERATE (CVSS 6.5) hax cms vulnerable to local vulnerability (CWE-73: External Control of File Name or Path) affecting Elmsln/haxcms libraries in the Packagist ecosystem. The issue involves hax cms vulnerable to local file inclusion via saveoutline api location parameter. Remediation is available by upgrading affected packages to version 11.0.0.
CVE-2025-49138 at a Glance
Security Impact
CVSS: 6.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
How to Fix CVE-2025-49138
To remediate this vulnerability, upgrade all affected Elmsln/haxcms dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade elmsln/haxcms to 11.0.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for elmsln/haxcmsHow to Check if You Are Affected
To determine whether your application is affected by CVE-2025-49138, inspect your project dependencies for Elmsln/haxcms:
inspect dependencies for elmsln/haxcmsAnalyze the terminal output to locate any version of Elmsln/haxcms in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 11.0.0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-73: External Control of File Name or Path, where the product allows user input to control or influence paths or file names that are used in filesystem operations. In Elmsln/haxcms, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-49138 Affected Elmsln/haxcms Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
elmsln/haxcms
|
Packagist |
< 11.0.0
|
11.0.0
|
References
Frequently Asked Questions
What is CVE-2025-49138?
Which Elmsln/haxcms versions are affected?
What version fixes CVE-2025-49138?
Is elmsln/haxcms affected?
What is the CVSS score of CVE-2025-49138?
What CWE is associated with CVE-2025-49138?
How can I check Packagist dependencies for CVE-2025-49138?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-hxrr-x32w-cg8g",
"modified" : "2025-06-09T21:44:03Z",
"published" : "2025-06-09T17:47:06Z",
"aliases" : [ "CVE-2025-49138" ],
"summary" : "HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter",
"details" : "### Summary\nAn authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data).\n\n### Details\nThe vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input.\n\nLater the location parameter is interpreted by the CMS like in[ HAXCMSSite.php line 1248](https://github.com/haxtheweb/haxcms-php/blob/b158d8ba1f9602af92ab084fd03b418f953079fd/system/backend/php/lib/HAXCMSSite.php#L1248) to resolve and load the content for a given node. If the location field contains a relative path like ../../../etc/passwd, the application will attempt to read and render that file.\n\n### PoC\n1. Authenticate to the CMS and retrieve the JWT and CSRF token.\n\n2. Issue a POST request to /system/api/saveOutline with the path traversal injection via the location parameter :\n\n<img width=\"839\" alt=\"LFI\" src=\"https://github.com/user-attachments/assets/91b1bb7f-9248-40d2-81fc-f839beb4d39c\" />\n\n3. Curl the website root to see the file contents.\n\n\n\n\n### Impact\nThis is an authenticated Local File Inclusion (LFI) vulnerability, via the location parameter the attacker can read any file on the filesystem that is accessible by the www-data user.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "elmsln/haxcms"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "11.0.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/haxtheweb/issues/security/advisories/GHSA-hxrr-x32w-cg8g"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-49138"
}, {
"type" : "WEB",
"url" : "https://github.com/haxtheweb/haxcms-php/blob/b158d8ba1f9602af92ab084fd03b418f953079fd/system/backend/php/lib/HAXCMSSite.php#L1248"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/haxtheweb/issues"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-22", "CWE-73" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2025-06-09T17:47:06Z",
"nvd_published_at" : "2025-06-09T21:15:47Z"
}
}