CVE-2026-46397 is a path traversal vulnerability (CWE-22) in haxtheweb's haxcms-php product affecting versions before 26.0.0. The vulnerability arises from improper limitation of a pathname in the saveOutline endpoint, which allows authenticated users with low privileges to perform Local File Inclusion (LFI) by manipulating the location field written into site.json. This can lead to unauthorized reading of arbitrary files accessible to the web server user, including sensitive system files like /etc/passwd and application secrets. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, requiring privileges but no user interaction, and impacts confidentiality but not integrity or availability. Version 26.0.0 of haxcms-php addresses this vulnerability.

An attacker with low-level authenticated access can read arbitrary files on the server, potentially exposing sensitive information such as system user data, application secrets, and configuration files accessible to the web server process. This compromises confidentiality but does not affect integrity or availability.

Upgrade haxcms-php to version 26.0.0 or later, where this vulnerability is patched. No other official remediation or temporary fixes are documented. Until upgraded, restrict access to the saveOutline endpoint to trusted users only.