elmsln/haxcms

Headless CMS for managing and publishing hybrid static, web component driven sites.

Latest 0.12.3

Packagist

78%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Are you affected? Scan for Free

Health Score Breakdown

Release history

The registry has had no release in about 7 years, with 17 releases overall and none in the last 12 months. This is a meaningful release-maintenance concern, although the linked repository shows recent activity.

Version stability

Version 0.12.3 is not a prerelease, so consumers are not being asked to depend on an explicitly unstable build. The 0.x major version still signals a less mature compatibility commitment.

Workflow audit

All three workflows were analyzed with no untrusted checkout or script-injection findings, but one high-confidence medium-severity finding identifies an archived action, and one workflow has top-level write permissions. These are actionable workflow hygiene concerns.

Vulnerabilities

Title	Versions	Severity
CVE-2025-49138 elmsln/haxcms is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 11.0.0.	0.0.0 - 11.0.0	Medium
CVE-2025-49137 elmsln/haxcms is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 11.0.0.	0.0.0 - 11.0.0	High

Package versions

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
twig/twig Version ^2.0	—	—
guzzlehttp/guzzle Version ^6.3	—	—
symfony/filesystem Version ^4.2	—	—
gumlet/php-image-resize Version ^1.9	—	—
icamys/php-sitemap-generator Version ^1.0	—	—