CVE-2026-22704: HAXcms Stored XSS Vulnerability Leading to Account Takeover
Summary
CVE-2026-22704: HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover. Affects @haxtheweb/haxcms-nodejs versions >= 11.0.6, < 25.0.0. Fixed in 25.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HAXcms is an open-source content management system designed for creating and managing web content. It provides a user-friendly interface for administrators to upload files, manage content, and configure site settings. However, it is vulnerable to a stored cross-site scripting (XSS) attack, which can allow attackers to execute malicious scripts in the context of an administrator's session, leading to potential account takeover.
Vulnerability Detail
The vulnerability arises from the ability of an attacker to upload an HTML file containing a JavaScript payload. When a logged-in administrator visits the URL of the uploaded file, the script executes and makes a fetch request to the /system/api/refreshAccessToken endpoint. This request includes the administrator's refresh token, allowing the attacker to obtain a valid JWT access token. The attacker can then take full control of the application, compromising sensitive data and functionality.
How To Fix
Minimum fixed version
25.0.0
This is the first release that contains the fix.
npm install @haxtheweb/haxcms-nodejs@25.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict file uploads to only allow specific file types and implement strict validation on uploaded files to prevent the execution of malicious scripts. Additionally, ensure that administrators are educated about the risks of clicking on untrusted links.
Conclusion
The stored XSS vulnerability in HAXcms poses a significant risk to applications using this content management system. By updating to the latest version and implementing recommended workarounds, administrators can protect their applications from potential attacks.
See every vulnerability recorded for @haxtheweb/haxcms-nodejs →
FAQ
The vulnerability is a stored XSS that allows attackers to execute scripts in the context of an administrator's session.
If exploited, an attacker can gain access to an administrator's JWT, leading to full control over the application and potential data breaches.
Yes, updating to version 25.0.0 or later of the @haxtheweb/haxcms-nodejs package will patch the vulnerability.
Implement strict file upload restrictions and educate users about the risks of clicking on untrusted links as a temporary measure.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities by analyzing your package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for @haxtheweb/haxcms-nodejs.
