Skip to main content

Microweber CMS CVE-2026-65694

| EUVDEUVD-2026-48438 HIGH
Path Traversal (CWE-22)
2026-07-23 VulnCheck GHSA-88w5-8c88-9jhr
Path Traversal Microweber
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Unauthenticated remote GET with no interaction gives AV:N/AC:L/PR:N/UI:N; impact is arbitrary file read so C:H with I:N/A:N and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 23, 2026 - 22:03 vuln.today
Analysis Generated
Jul 23, 2026 - 22:03 vuln.today
CVE Published
Jul 23, 2026 - 21:20 cve.org
HIGH 8.7

DescriptionCVE.org

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalize_path() to strip traversal sequences, disclosing sensitive files such as environment configuration files containing credentials and system files.

AnalysisAI

Unauthenticated arbitrary file read in Microweber CMS through version 2.0.20 lets remote attackers retrieve sensitive files via directory traversal in the static file controller (ServeStaticFileContoller). Because the controller trusts the attacker-controlled ?path= query input over the bound route segment and normalize_path() fails to strip traversal sequences, a single unauthenticated HTTP GET can disclose environment configuration files containing credentials and other system files. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify internet-facing Microweber ≤2.0.20
Delivery
Send GET with ?path= traversal sequence
Exploit
Bypass normalize_path() sanitization
Execution
Read arbitrary file (e.g. .env)
Impact
Harvest credentials for lateral movement
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No authentication, user interaction, or non-default setup is required: any internet-reachable Microweber CMS instance at or below version 2.0.20 exposing the ServeStaticFileContoller static file route is exploitable by supplying traversal sequences in the ?path= query parameter, which overrides the {path} route segment via Laravel's Request::__get. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine, easily exploitable priority rather than a paper-high score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker identifies a public Microweber site (≤2.0.20) and issues a single unauthenticated GET request to the static file controller with ?path=../../../../.env (and traversal variants), which normalize_path() fails to sanitize. The response returns the application's environment file, disclosing database, mail, and API credentials that the attacker then reuses to pivot into backend systems. …
Remediation Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change from https://github.com/microweber/microweber/pull/1181, which switches the controller to use the bound route segment ($request->route('path')) instead of the overridable request input and confines the resolved path under realpath(userfiles_path()) with a realpath() plus strncmp prefix check, returning 404 on escape. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Microweber CMS deployments and confirm versions; disable or restrict access to the affected static file controller if operationally feasible. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Microweber

View all
CVE-2025-34076 HIGH POC
7.2 Jul 02

An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the ba
CVE-2023-1877 CRITICAL POC
9.8 Apr 05

Command Injection in GitHub repository microweber/microweber prior to 1.3.3. Rated critical severity (CVSS 9.8), this vu
CVE-2022-2368 CRITICAL POC
9.8 Jul 11

Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20. Rated critical severity (C
CVE-2022-0895 CRITICAL POC
9.8 Mar 10

Static Code Injection in GitHub repository microweber/microweber prior to 1.3. Rated critical severity (CVSS 9.8), this

CVE-2023-49052 HIGH POC
8.8 Nov 30

File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script

CVE-2022-33012 HIGH POC
8.8 Nov 22

Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.

CVE-2022-1631 HIGH POC
8.8 May 09

Users Account Pre-Takeover or Users Account Takeover. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
CVE-2022-0896 HIGH POC
8.8 Mar 09

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior t
CVE-2018-17104 HIGH POC
8.8 Sep 16

An issue was discovered in Microweber 1.0.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
CVE-2026-65693 HIGH POC
8.6 Jul 24

Authenticated administrators can execute arbitrary OS commands on Microweber CMS through 2.0.20 by injecting unsandboxed
CVE-2014-9464 HIGH POC
7.5 Jan 03

SQL injection vulnerability in Category.php in Microweber CMS 0.95 before 20141209 allows remote attackers to execute ar
CVE-2020-13241 HIGH POC
7.8 May 20

Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not veri

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Share

CVE-2026-65694 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy