CVE-2026-46390

MediumCVSS 6.9

Published: 05/06/2026(UTC)Updated: 09/06/2026(UTC)Translated: 10/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.05%

16th percentile - higher than 16% of all known CVEs

Summary

HAX CMS versions from 2.0.0 to 26.0.0 have the gitlist plugin exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history.

Risk Assessment

Organizations may be exposed to the disclosure of sensitive information contained in git repositories, potentially leading to data security breaches.

Recommendation

It is recommended to upgrade to version 26.0.0 or later to patch this vulnerability.

Original NVD description (English source)

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history. Version 26.0.0 patches the issue.