CVE-2025-32028 – HAX CMS PHP allows Insecure File Upload to Lead to Remote Code Execution

https://notcve.org/view.php?id=CVE-2025-32028

08 Apr 2025 — HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ function in ’HAXCMSFile.php’. This save function uses a denylist to block specific file types from being uploaded to the server. This list is non-exhaustive and only blocks ’.php’, ’.sh’, ’.js’, and ’.css’ files. The existing logic causes the system to "fail open" rather than "fail closed." • https://github.com/haxtheweb/issues/security/advisories/GHSA-vj5q-3jv2-cg5p • CWE-434: Unrestricted Upload of File with Dangerous Type •