CVE-2025-32028: psu haxcms-php

csirt@kutim:~/threat-intel/cve/CVE-2025-32028

CVSS 9.9 · Critical EPSS 2,0%

Kerentanan Unrestricted Upload of File with Dangerous Type pada psu haxcms-php. Skor CVSS 3.1 9.9 (Critical) menurut github.com.

Deskripsi (NVD)

HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ function in ’HAXCMSFile.php’. This save function uses a denylist to block specific file types from being uploaded to the server. This list is non-exhaustive and only blocks ’.php’, ’.sh’, ’.js’, and ’.css’ files. The existing logic causes the system to "fail open" rather than "fail closed." This vulnerability is fixed in 10.0.3.

Rincian

Terbit di NVD: 8 April 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.9 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-434: Unrestricted Upload of File with Dangerous Type
EPSS (30 hari): 2,0% peluang dieksploitasi; lebih tinggi dari 80,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
psu	haxcms-php	Versi 9.0.0 hingga sebelum 10.0.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/haxtheweb/issues/security/advisories/GHSA-vj5q-3jv2-cg5p exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.