CVE-2026-46399

RCE

RCE Command Injection Path Traversal

Published

05 June 2026

Modified

17 June 2026

CVSS Score v4 9.4

Click a component to see what it means

Raw vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0029 21th percentile

Risk Priority 39 floored blend · peak EPSS

Summary

CVE-2026-46399 is a critical-severity External Control of System or Configuration Setting (CWE-15) vulnerability. Its CVSS base score is 9.4 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-34880

Vulnerability Data

HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Git filter commands and…

achieve code execution on the HAX CMS server. Version 26.0.0 patches the issue.

CWE(s): CWE-15 CWE-73 CWE-78

Related Threats

MITRE ATT&CK Enterprise Techniques

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

T1059.003 Windows Command Shell Execution

Adversaries may abuse the Windows command shell for execution.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

T1574.007 Path Interception by PATH Environment Variable Stealth

Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1059.001 PowerShell Execution

Adversaries may abuse PowerShell commands and scripts for execution.

attack.mitre.org →

Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-45087Shared CWE-15, CWE-78

CVE-2024-8517Shared CWE-73, CWE-78

CVE-2026-11526Shared CWE-73, CWE-78

CVE-2026-11527Shared CWE-73, CWE-78

CVE-2026-8450Shared CWE-73, CWE-78

CVE-2026-45556Shared CWE-73, CWE-78

CVE-2025-48385Shared CWE-73

CVE-2024-0292Shared CWE-78

CVE-2023-40479Shared CWE-78

CVE-2025-33206Shared CWE-78

Affected Assets

—

The PHP

inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent

Stop it (NIST 800-53)

—

Detect

Catch it (NIST detect / respond)

—

Harden

Shrink the surface (DISA STIG)

4 hardening rules · 2 OS baselines

Validate

Prove the fix (OWASP ASVS)

V5.3.2
V1.2.5
V1.2.8
V15.2.5

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Enforces approved authorizations for logical access to configuration resources so external parties cannot alter them.

CM-5 Access Restrictions for Change good match

Enforces documented access restrictions on all changes to system configuration, directly blocking unauthorized external control of settings.

AC-6 Least Privilege good match

Limits privileges to the minimum needed, reducing the set of users who can externally modify configuration.

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation can discover missing or incorrect command sanitization during development.

SI-10 Information Input Validation good match

Input validation directly rejects or sanitizes untrusted path strings before they reach filesystem operations.

CM-7 Least Functionality partial match

Least functionality restricts available OS commands and interpreters, limiting the blast radius of injection.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match

prevents

Secure SDLC practices include input validation and path sanitization that eliminate this weakness.

PR.AA-05 mostly match

prevents

Least-privilege file authorization directly limits damage from externally controlled paths.

PR.PS-01 mostly match

prevents

Hardened configuration baselines and change controls directly limit external manipulation of settings.

ID.RA-07 partial match

prevents

Formal change and exception management catches externally driven configuration alterations.

PR.PS-02 partial match

prevents

Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.9 Configuration management full match

degrades

Configuration management directly prevents external tampering with system settings.

A.5.18 Access rights mostly match

prevents

Access rights assignment determines who may change system settings.

A.8.2 Privileged access rights mostly match

prevents

Privileged access rights reduce the number of users who can alter configuration.

A.8.29 Security testing in development and acceptance mostly match

finds

Security testing can detect path-traversal issues but does not itself implement preventive controls.