CVE-2026-46400 is a vulnerability in haxtheweb's haxcms-php where the file upload feature inadequately validates uploaded files by only checking file extensions with a regex pattern. This insufficient validation allows attackers to upload files with dangerous content (e.g., PHP webshells) disguised as benign image files. The vulnerability affects versions starting from 11.0.6 up to but not including 25.0.0. The issue is resolved in version 25.0.0, which implements proper validation beyond just file extensions.

Successful exploitation can lead to remote code execution on the affected system due to the upload of malicious executable files disguised as images. This can compromise the integrity and confidentiality of the system running haxcms-php versions prior to 25.0.0. The CVSS 4.0 score of 8.7 reflects a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Upgrade haxcms-php to version 25.0.0 or later, where the vulnerability is fixed by improved file upload validation that checks file content and MIME type, not just file extensions. Since no official patch or temporary fix is listed other than the version upgrade, applying this update is the recommended remediation. Patch status is confirmed by the vendor's versioning information indicating the fix is included starting in version 25.0.0.