CVE-2026-48527: HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint

HaxCMS is affected by a stored cross-site scripting (XSS) vulnerability in the /system/api/saveNode endpoint. An authenticated user with a permission to edit pages can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name.

For example, the sanitizer misses:

<a href="#"onclick="alert('kn1ph')">click me</a>

The important bypass is:

href="#"onclick=

The payload is stored in the generated page files and executes when a user clicks the injected link.