The vulnerability is an authenticated file overwrite flaw in the PHP backend of HAX CMS, which permits an attacker with valid credentials to replace critical configuration files. By configuring malicious Git filter commands, the attacker can trigger the execution of arbitrary code on the server. This flaw maps to CWE-15, CWE-73, and CWE-78 and results in full remote code execution, compromising confidentiality, integrity, and availability.

HAX CMS from haxtheweb, specifically the PHP backend before version 26.0.0, is affected. The Node.js variant is also listed by the CNA, though the description focuses on PHP. Administrators should verify that their installation is on or above 26.0.0 or remove the vulnerable component.

The CVSS score of 9.4 denotes critical severity. While the EPSS score is not available, the lack of a KEV listing does not reduce the threat. Exploitation requires authenticated access to the CMS; an attacker can upload a crafted configuration file that the application interprets as a Git filter, leading to arbitrary command execution with the privileges of the web server. A single compromised account can subvert the entire installation.