CVE-2025-49141: Psu Haxcms-Node.js

High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days.

HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the `gitImportSite` functionality obtains a URL string from a POST request and insufficiently validates user input. The `set_remote` function later passes this input into `proc_open`, yielding OS command injection. An authenticated attacker can craft a URL string that bypasses the validation checks employed by the `filter_var` and `strpos` functions in order to execute arbitrary OS commands on the backend server. The attacker can exfiltrate command output via an HTTP request. Version 11.0.3 contains a patch for the issue.

Affected products

• Psu Haxcms-Node.js: before 11.0.3 (fixed in 11.0.3)
• Psu Haxcms-PHP: before 11.0.0 (fixed in 11.0.0)

Published 2025-06-09. Last modified 2026-06-17.