HAX CMS, a content management system with PHP and NodeJs backends, has an authenticated file overwrite vulnerability in its PHP version before 26.0.0. This flaw permits an attacker with authentication to manipulate system or configuration settings by overwriting files, specifically to set malicious Git filter commands. Successful exploitation results in remote code execution on the server hosting HAX CMS. Version 26.0.0 includes a patch that addresses this vulnerability. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements.

An authenticated attacker can overwrite files to configure malicious Git filter commands, leading to remote code execution on the HAX CMS server. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability is critical due to the potential for full system compromise.

Upgrade the PHP version of HAX CMS to version 26.0.0 or later, which contains the official patch for this vulnerability. Since the vendor advisory confirms the issue is fixed in version 26.0.0, applying this update fully mitigates the risk. No additional mitigation steps are indicated.