Microweber CMS CVE-2025-34076

Requires a valid authenticated session with access to Microweber's backup management functionality (CVSS PR:L); the attacker supplies an absolute file path in the src parameter of the /api/BackupV2/upload endpoint and then reads it back via /api/BackupV2/download. Exploitation stems from insufficient validation of user-supplied paths in the backup logic. Limiting factors: an authenticated account is required (not remote-unauthenticated), the instance must expose the admin backup API, and the destructive file relocation/deletion outcome (vs. pure read) is contingent on the web service user's filesystem privileges (CVSS AT:P). Fixed versions after 1.2.11 enforce a json/zip extension allowlist, closing arbitrary-file retrieval.

This is a moderate-severity authenticated path traversal (CWE-22) in Microweber CMS with a mixed risk signature. The CVSS 4.0 base score is 6.1 (medium) and the vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L) indicates a network-reachable but authenticated attack (PR:L) whose fuller impact depends on an attack requirement (AT:P) - namely the privileges of the web service user, which gates whether files can be relocated/deleted versus merely read. Countervailing this medium severity, the EPSS score of 21.32% at the 96th percentile is notably elevated, and a public Metasploit auxiliary module plus a huntr write-up exist, so the barrier to exploitation is low for anyone with a valid account. The vulnerability is NOT in CISA KEV, so there is no confirmed evidence of active in-the-wild exploitation; the high EPSS and POC availability signal strong exploitability potential rather than observed mass exploitation. Net: a real, prioritizable issue for internet-exposed Microweber instances given public exploit code and high EPSS, but the PR:L authentication requirement and medium CVSS temper it below a drop-everything emergency. Note a minor tension: the primary confirmed impact is confidentiality (VC:H, arbitrary file read), while integrity/availability (VI:L/VA:L - file relocation/deletion) are conditional on the server user's privileges, so real-world destructive impact will vary by deployment.

An attacker with a low-privileged authenticated account on an internet-facing Microweber instance (<=1.2.11) sends a crafted request to /api/BackupV2/upload specifying an absolute path such as /etc/passwd or a config file containing database/app secrets in the src parameter, then calls /api/BackupV2/download to retrieve the contents. A public Metasploit module (auxiliary/gather/microweber_lfi) and a huntr proof-of-concept exist, lowering the skill barrier. Because success of file relocation/deletion depends on the web service user's privileges, the attacker may also disrupt the installation, not merely read files.