EUVD-2026-36674
GHSA-vv4x-qcpq-wgrg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing Microweber instance
-
DeliverySend unauthenticated HTTP request to /api_nosession/thumbnail_img
-
ExploitInject traversal sequences into cache_path_relative parameter
-
Executionuserfiles_path resolves path outside intended directory
-
ImpactRead or write files accessible to web server process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The |
| Impact | The CVSS 4.0 base score is 5.5 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N, confirming trivial network exploitation with no authentication, no complexity, and no user interaction required. All three vulnerable-system impact metrics (VC:L/VI:L/VA:L) are rated Low, suggesting partial rather than full file system access - bounded by the web server process's OS-level permissions. The supplemental E:P metric confirms a public proof-of-concept exists, which materially increases real-world exploitation likelihood beyond what the base score alone suggests. No CISA KEV listing exists, so active exploitation in the wild is not confirmed at time of analysis. The vendor's failure to respond to disclosure is a compounding risk factor: no patch is available, and no official mitigations have been communicated. EPSS data is not provided in the source intelligence; risk prioritization should weight the PoC availability and unpatched status heavily. |
| Exploit ScenarioDerived | An unauthenticated attacker sends an HTTP GET or POST request to the publicly accessible |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Path traversal in Microweber CMS up to version 2.0.20 exposes the unauthenticated /api_nosession/thumbnail_img endpoint to file system manipulation via the cache_path_relative parameter of the userfiles_path function. Remote, unauthenticated attackers can traverse outside the intended directory to read - and potentially write - files accessible to the web server process. A public proof-of-concept exploit is available and the vendor did not respond to responsible disclosure, meaning no patch exists at time of analysis.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to the coordinated disclosure. Administrators should immediately restrict external access to the /api_nosession/thumbnail_img endpoint via WAF rules or reverse proxy ACLs; blocking requests with cache_path_relative values containing ../, %2e%2e, %2f, or null-byte sequences is a concrete first step, though WAF bypass is a known risk. Enforcing strict OS-level file system permissions so the web server process can only read from the intended public directories limits the traversal impact radius. Network-level controls to restrict the Microweber instance to trusted IP ranges (if operationally viable) further reduce exposure. Monitor the Microweber GitHub repository at https://github.com/microweber/microweber/ and VulDB entry at https://vuldb.com/vuln/370841 for a future patch release. The public PoC at https://github.com/whuHouYF/microweber-vuldb-disclosure-2026/blob/991630c494a99c70a96e456992a04de2ecb5a1e1/reports/microweber-path-traversal.md should be reviewed to inform specific WAF signatures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Microweber is an open-source PHP-based CMS and e-commerce platform. The vulnerable endpoint /api_nosession/thumbnail_img is a no-session (unauthenticated) API route designed for thumbnail image generation. The userfiles_path function within this endpoint accepts a cache_path_relative argument and uses it in file system path construction without adequate sanitization, triggering CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). By injecting path traversal sequences such as ../ or URL-encoded equivalents, an attacker can escape the intended thumbnail cache directory and access arbitrary files readable or writable by the web server process. The CPE cpe:2.3:a:n/a:microweber:*:*:*:*:*:*:*:* covers all tracked versions up to and including 2.0.20.
Know when Microweber gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
No-session endpoint requires no authentication (PR:N, AV:N); path traversal yields limited file read/write with no availability impact and no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file /api_nosession/thumbnail_img of the component API Endpoint. Executing a manipulation of the argument cache_path_relative can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Microweber
View allAuthenticated arbitrary file disclosure in Microweber CMS 1.2.11 and earlier lets any logged-in user read files from the
Command Injection in GitHub repository microweber/microweber prior to 1.3.3. Rated critical severity (CVSS 9.8), this vu
Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20. Rated critical severity (C
Static Code Injection in GitHub repository microweber/microweber prior to 1.3. Rated critical severity (CVSS 9.8), this
Unauthenticated arbitrary file read in Microweber CMS through version 2.0.20 lets remote attackers retrieve sensitive fi
File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script
Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.
Users Account Pre-Takeover or Users Account Takeover. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior t
An issue was discovered in Microweber 1.0.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Authenticated administrators can execute arbitrary OS commands on Microweber CMS through 2.0.20 by injecting unsandboxed
SQL injection vulnerability in Category.php in Microweber CMS 0.95 before 20141209 allows remote attackers to execute ar
Exploit-DB