HAX CMS helps manage microsite universe with PHP or NodeJs backends. An authenticated Server-Side Request Forgery (SSRF) vulnerability in versions prior to 26.0.0 allows authenticated users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and internal network access. Version 26.0.0 contains a fix.

Affected: npm: @haxtheweb/haxcms-nodejs

### Summary An authenticated Server-Side Request Forgery (SSRF) vulnerability in HAXcms allows users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and internal network access.

### Details The `createSite` endpoint in HAXcms (v11.0.6) accepts a `build.files` parameter that allows an authenticated user to supply arbitrary URLs or local file paths. This input is processed without validation and ultimately fetched server-side using `file_get_contents()`.

The data flow is as follows: - User input (`build.files`) is processed via `object_to_array()` into a PHP array - Assigned to `$filesToDownload` in `Operations.php` (line 2626) - Iterated over in `Operations.php` (line 2730), where each entry is passed to `HAXCMSFile::save()` with bulk-import enabled

In `HAXCMSFile.php` (line 30), the following occurs: ```php file_get_contents($upload['tmp_name']); ```

Here, tmp_name is attacker-controlled and may contain:

- External URLs (`http://attacker.com`) - Internal services (`http://127.0.0.1`) - Cloud metadata endpoints (`http://169.254.169.254`) - Local file paths (`/etc/passwd`, `/proc/self/environ`)

The bulk-import flag bypasses `is_uploaded_file()` validation, which normally ensures the file originates from a legitimate upload. The only restriction is an extension whitelist based on the filename (array key), which is fully attacker-controlled.

There are no restrictions on:

- URL sc…