HAX CMS prior to version 26.0.0 contains an operating‑system command injection flaw in the Git.php library of its PHP backend. The library builds shell command strings from user-supplied parameters and invokes them with proc_open(). Only the commit() function protects arguments with escapeshellarg(), while sixteen additional functions expose the raw input. An attacker able to submit crafted values to any of these Git operations can execute arbitrary shell commands with the privileges of the web server, leading to remote code execution and potentially full system compromise when combined with other configuration‑manipulation weaknesses.

The affected product is haxtheweb’s HAX CMS PHP backend. Versions older than 26.0.0 are vulnerable. No specific patch versions beyond 26.0.0 are listed, but the advisory states that applying the 26.0.0 update resolves the issue.

The CVSS score of 7.7 signifies a high severity level. No EPSS score is publicly available, but the absence of a KEV listing does not diminish the risk; command injection remains a critical threat if the attacker can reach the Git functionality. The vulnerability can be exploited from a remote web request that provides the vulnerable parameters, and the impact is complete control over the underlying operating system. When combined with a separate vulnerability that allows configuration changes, the risk escalates to full system compromise. Administrators should treat this as a high‑priority issue.