HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire application offline, requiring a manual server restart to restore service. Version 26.0.0 fixes the issue.

Affected: npm: @haxtheweb/haxcms-nodejs

### Summary

The HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire application offline, requiring a manual server restart to restore service.

### Details

The `createSite` remote import flow does **not** complete end-to-end. Instead, the server crashes before the outbound HTTP fetch happens.

The crash occurs because `createSite` passes a file object without `originalname`, while `HAXCMSFile.save()` immediately dereferences `tmpFile.originalname.replace(...)`.

As a result:

- the request reaches privileged code inside `createSite` - the server hits the remote file handling path - the process crashes before `downloadAndSaveFile()` performs the outbound request - no imported file is written into the site directory

### Affected Resources

- src/routes/createSite.js:176 - src/lib/HAXCMSFile.js:25 - system/api/createSite

### PoC

1. Obtain a JWT by logging in with valid credentials.

```bash JWT=$(curl -s -X POST 'http://127.0.0.1:3000/system/api/login' \ -H 'Content-Type: application/json' \ -d '{"username":"admin","password":"admin"}' | grep -o '"jwt":"[^"]*"' | head -1 | cut -d'"' -f4) ```

2. Extract the required tokens from the `connectionSettings` endpoint.

```bash SETTINGS=$(curl -s 'http://127.0.0.1:3000/system/api/connectionSettings') ROOT_TOKEN=$(printf '%s' "$SETTINGS" | grep -o '"token":"[^"]*"' | head -1 | cut -d'"' -f…