The vulnerability identified as CVE-2026-46400 in haxtheweb's haxcms-php affects versions >=11.0.6 and <25.0.0. The file upload feature relies solely on regex-based file extension validation, lacking content or MIME type verification. This permits attackers to upload dangerous files such as PHP webshells under the guise of image files, which can lead to remote code execution on the server. The issue is categorized under CWE-434 (Unrestricted Upload of File with Dangerous Type). A fix is included starting in version 25.0.0.

Successful exploitation can lead to remote code execution due to the upload of malicious files disguised as images. This compromises the server hosting haxcms-php, potentially allowing attackers to execute arbitrary code with the privileges of the web server process.

Upgrade haxcms-php to version 25.0.0 or later, where the vulnerability has been fixed. The fix involves proper validation beyond file extension regex, including checking file content or MIME type. Until upgrading, restrict file upload permissions and monitor for suspicious uploads as a temporary measure. Patch status is not explicitly stated in the vendor advisory, but version 25.0.0 contains the fix.