CVE-2026-48527: HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint

May 29, 2026 (updated June 9, 2026)

HaxCMS is affected by a stored cross-site scripting (XSS) vulnerability in the /system/api/saveNode endpoint. An authenticated user with a permission to edit pages can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name.

For example, the sanitizer misses:

<a href="#"onclick="alert('kn1ph')">click me</a>

The important bypass is:

href="#"onclick=

The payload is stored in the generated page files and executes when a user clicks the injected link.

References

Code Behaviors & Features

Detect and mitigate CVE-2026-48527 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →