CVE-2026-22704: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22704 is a stored cross-site scripting (XSS) vulnerability in HAX CMS (haxcms-nodejs and haxcms-php) that can lead to full administrator account takeover. It affects versions 11.0.6 through before 25.0.0 of the @haxtheweb/haxcms-nodejs npm package. The vulnerability was disclosed on January 9, 2026, by researcher August829, with the GitHub Advisory (GHSA-3fm2-xfq7-7778) published the same day and the NVD entry following on January 10, 2026. The CVSS v3.1 base score is 8.0 (High) per the GitHub Advisory, reflecting high confidentiality, integrity, and availability impacts (Github Advisory, haxtheweb Advisory).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), specifically the application's failure to restrict the file types that authenticated users can upload via the /system/api/saveFile endpoint. An attacker with low privileges can upload an .html file containing arbitrary JavaScript to a site's files/ directory, which the server then serves with a content type that allows browser execution rather than forcing a download. The fix applied in commit 317a8ae adds middleware to src/app.js that sets the Content-Disposition: attachment header for any .html or .htm files served from /files/ paths, preventing browsers from rendering them as active pages (haxtheweb Advisory, Patch Commit).

Successful exploitation allows an attacker to steal a valid administrator JWT access token, enabling complete account takeover and full control of the HAX CMS application. The stored XSS payload executes in the context of any authenticated administrator who visits the malicious URL, silently exfiltrating their session token to an attacker-controlled server. Because the scope is changed, the impact extends beyond the vulnerable component — an attacker gaining admin credentials can modify site content, access sensitive data, and potentially pivot to other systems or users managed by the CMS (Github Advisory, haxtheweb Advisory).

A detailed proof-of-concept exploit chain is publicly documented in the GitHub Security Advisory and has also been published to Exploit-DB (EDB-ID: 52526) (haxtheweb Advisory, Exploit-DB). The EPSS score is approximately 0.037% (11th percentile), indicating a low but non-zero probability of exploitation in the near term. There is no current evidence of in-the-wild exploitation or CISA KEV catalog listing. Exploitation requires the attacker to have low-privileged authenticated access to the CMS and requires social engineering to trick an administrator into visiting the malicious URL.

1. Authenticate: Log in to the HAX CMS instance with any low-privileged account to obtain a valid JWT and site token.
2. Craft malicious HTML payload: Create an .html file containing a JavaScript payload that fetches /system/api/refreshAccessToken with a POST request, captures the returned JWT from the JSON response, and exfiltrates it to an attacker-controlled server (e.g., a Burp Collaborator or similar OOB endpoint).
3. Upload the payload: Send a POST request to /system/api/saveFile?siteName=<target_site>&site_token=<token>&jwt=<attacker_jwt> with the malicious .html file as a multipart upload, placing it in the files/ directory (e.g., filename="files/pwn.html").
4. Deliver the link: Trick a logged-in administrator into visiting the URL of the uploaded file (e.g., http://<target>/sites/<siteName>/files/pwn.html) via phishing, a shared link, or an embedded reference.
5. JWT theft: When the administrator's browser loads the page, the JavaScript executes, uses the administrator's haxcms_refresh_token cookie to obtain a fresh JWT from the server, and sends it to the attacker's server.
6. Account takeover: Use the stolen administrator JWT in subsequent API requests to take full control of the HAX CMS application, including modifying content, managing users, and accessing sensitive data (haxtheweb Advisory, Github Advisory).

• Network: Outbound HTTP requests from the HAX CMS server or administrator browsers to unknown external domains with JWT tokens in query parameters (e.g., GET https://<attacker-domain>/log?jwt=eyJ...); POST requests to /system/api/refreshAccessToken originating from a browser session shortly after a file access event.
• Logs: Web server access logs showing requests to /system/api/saveFile with .html filenames in the file-upload field from low-privileged accounts; subsequent access log entries for GET /sites/<siteName>/files/*.html from administrator IP addresses.
• File System: Unexpected .html files in site files/ directories containing JavaScript fetch() calls, particularly targeting /system/api/refreshAccessToken or exfiltrating data to external URLs.
• Application: Anomalous JWT token usage — valid administrator JWTs being used from IP addresses or user agents inconsistent with the legitimate administrator's session (haxtheweb Advisory).

Upgrade @haxtheweb/haxcms-nodejs to version 25.0.0 or later, which adds middleware to force Content-Disposition: attachment for HTML files served from files/ directories, preventing browser execution of uploaded scripts (haxtheweb Release, Patch Commit). As an interim workaround, restrict file upload permissions to trusted administrators only and audit existing files/ directories for unexpected .html files. Organizations should also consider implementing a web application firewall rule to block serving of HTML files from user-upload directories.

The vulnerability was covered by The Hacker Wire and referenced in CISA's vulnerability bulletin for the week of January 5, 2026 (CISA Bulletin). The Exploit-DB publication of a working PoC (EDB-ID: 52526) in mid-2026 drew additional attention from the security community via Mastodon and aggregator sites. No major vendor statements beyond the original maintainer advisory have been identified.