An injection flaw in HAX CMS PHP allows an attacker to store a malicious script that will execute in the victims' browsers when the uploaded file is viewed. The vulnerability stems from a case‑sensitivity mismatch between the file‑extension validation logic and the .htaccess rule that forces HTML downloads. Files uploaded with an upper‑case extension are written to disk but still served with the text/html content type, allowing inline rendering and script execution. The flaw is classified as a high‑severity stored cross‑site scripting flaw (CWE-178) coupled with insecure file upload handling (CWE-434).

HAX CMS PHP installations running any version prior to 26.0.0 of the PHP backend are affected. Users with the legacy upload component exposed through the saveFile endpoint are at risk if they accept uploads of HTML files with mixed‑case extensions.

The CVSS score of 8.7 signals substantial impact potential. Attackers can exploit the flaw remotely by sending a crafted upload to the public saveFile endpoint. No exploitation data is currently listed in the CISA KEV catalog, and the EPSS score is not available, but the high severity suggests a significant risk, especially in environments where unauthenticated upload is permitted.