CVE-2025-49141

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-49141

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49141.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-49141

Aliases

GHSA-g4cf-pp4x-hqgw

Published

2025-06-09T21:11:08.889Z

Modified

2026-08-12T03:51:32.099741243Z

Severity

8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

HaxCMS-PHP Command Injection Vulnerability

Details

HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the gitImportSite functionality obtains a URL string from a POST request and insufficiently validates user input. The set_remote function later passes this input into proc_open, yielding OS command injection. An authenticated attacker can craft a URL string that bypasses the validation checks employed by the filter_var and strpos functions in order to execute arbitrary OS commands on the backend server. The attacker can exfiltrate command output via an HTTP request. Version 11.0.3 contains a patch for the issue.

Database specific

{
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49141.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/haxtheweb/haxcms-nodejs

Affected ranges

Type

GIT

Repo

https://github.com/haxtheweb/haxcms-nodejs

Events

Introduced

Fixed

150773eb8b5abd97fa8eacdd74d21bd2d2da4c62

Fixed

5131fea6b6be611db76a618f89bd2e164752e9b3

Database specific

Show details

{
    "cpe": "cpe:2.3:a:psu:haxcms-nodejs:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "11.0.3"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Type

GIT

Repo

https://github.com/haxtheweb/haxcms-php

Events

Introduced

Fixed

557c8ca02fe349c8e590d83e7310b34832ff3e38

Database specific

Show details

{
    "cpe": "cpe:2.3:a:psu:haxcms-php:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "11.0.0"
        }
    ]
}

Affected versions

0.*

0.0.1

0.1.0

0.11.0

0.12.0

0.12.1

0.12.2

0.12.3

0.2.0

0.3.0

0.4.0

0.5.0

0.6.0

0.7.0

0.8.0

0.8.1

0.8.2

0.9.0

1.*

1.0.0

1.1.0

1.1.1

1.1.2

1.1.3

1.2.0

1.2.1

1.2.10

1.2.11

1.2.12

1.2.13

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.3.0

1.3.1

1.4.0

10.*

10.0.0

10.0.3

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

3.*

3.0.0

4.*

4.0.0

4.1.0

5.*

5.1.0

6.*

6.0.1

7.*

7.0.1

7.0.10

7.0.13

7.0.14

7.0.15

7.0.16

7.0.2

7.0.3

8.*

8.0.0

9.*

9.0.21

v0.*

v0.0.10

v0.0.11

v0.0.12

v0.0.13

v0.0.14

v0.0.15

v0.0.16

v0.0.17

v0.0.18

v0.0.19

v0.0.2

v0.0.3

v0.0.4

v0.0.5

v0.0.6

v0.0.7

v0.0.8

v0.0.9

v10.*

v10.0.1

v10.0.2

v10.0.3

v10.0.4

v10.0.5

v10.0.6

v11.*

v11.0.0

v11.0.1

v11.0.2

v9.*

v9.0.0

v9.0.0-alpha.0

v9.0.0-alpha.1

v9.0.1

v9.0.10

v9.0.11

v9.0.12

v9.0.13

v9.0.14

v9.0.15

v9.0.16

v9.0.17

v9.0.18

v9.0.19

v9.0.2

v9.0.20

v9.0.21

v9.0.3

v9.0.4

v9.0.5

v9.0.6

v9.0.7

v9.0.8

v9.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49141.json"