Security Advisory

CVE-2025-32028

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2025-04-08 16:06:33

Last updated 2025-04-08 20:00:56

Assigner GitHub_M

State PUBLISHED

Description

HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ function in ’HAXCMSFile.php’. This save function uses a denylist to block specific file types from being uploaded to the server. This list is non-exhaustive and only blocks ’.php’, ’.sh’, ’.js’, and ’.css’ files. The existing logic causes the system to "fail open" rather than "fail closed." This vulnerability is fixed in 10.0.3.

← Browse all CVEs View on cve.org ↗