EUVD-2026-36674
GHSA-vv4x-qcpq-wgrg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No-session endpoint requires no authentication (PR:N, AV:N); path traversal yields limited file read/write with no availability impact and no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file /api_nosession/thumbnail_img of the component API Endpoint. Executing a manipulation of the argument cache_path_relative can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Path traversal in Microweber CMS up to version 2.0.20 exposes the unauthenticated /api_nosession/thumbnail_img endpoint to file system manipulation via the cache_path_relative parameter of the userfiles_path function. Remote, unauthenticated attackers can traverse outside the intended directory to read - and potentially write - files accessible to the web server process. A public proof-of-concept exploit is available and the vendor did not respond to responsible disclosure, meaning no patch exists at time of analysis.
Technical ContextAI
Microweber is an open-source PHP-based CMS and e-commerce platform. The vulnerable endpoint /api_nosession/thumbnail_img is a no-session (unauthenticated) API route designed for thumbnail image generation. The userfiles_path function within this endpoint accepts a cache_path_relative argument and uses it in file system path construction without adequate sanitization, triggering CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). By injecting path traversal sequences such as ../ or URL-encoded equivalents, an attacker can escape the intended thumbnail cache directory and access arbitrary files readable or writable by the web server process. The CPE cpe:2.3:a:n/a:microweber:*:*:*:*:*:*:*:* covers all tracked versions up to and including 2.0.20.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to the coordinated disclosure. Administrators should immediately restrict external access to the /api_nosession/thumbnail_img endpoint via WAF rules or reverse proxy ACLs; blocking requests with cache_path_relative values containing ../, %2e%2e, %2f, or null-byte sequences is a concrete first step, though WAF bypass is a known risk. Enforcing strict OS-level file system permissions so the web server process can only read from the intended public directories limits the traversal impact radius. Network-level controls to restrict the Microweber instance to trusted IP ranges (if operationally viable) further reduce exposure. Monitor the Microweber GitHub repository at https://github.com/microweber/microweber/ and VulDB entry at https://vuldb.com/vuln/370841 for a future patch release. The public PoC at https://github.com/whuHouYF/microweber-vuldb-disclosure-2026/blob/991630c494a99c70a96e456992a04de2ecb5a1e1/reports/microweber-path-traversal.md should be reviewed to inform specific WAF signatures.
More in Microweber
View allAn authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the ba
Command Injection in GitHub repository microweber/microweber prior to 1.3.3. Rated critical severity (CVSS 9.8), this vu
Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20. Rated critical severity (C
Static Code Injection in GitHub repository microweber/microweber prior to 1.3. Rated critical severity (CVSS 9.8), this
Unauthenticated arbitrary file read in Microweber CMS through version 2.0.20 lets remote attackers retrieve sensitive fi
File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script
Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.
Users Account Pre-Takeover or Users Account Takeover. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior t
An issue was discovered in Microweber 1.0.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Authenticated administrators can execute arbitrary OS commands on Microweber CMS through 2.0.20 by injecting unsandboxed
SQL injection vulnerability in Category.php in Microweber CMS 0.95 before 20141209 allows remote attackers to execute ar
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today