Microweber CMS EUVD-2026-48438

No authentication, user interaction, or non-default setup is required: any internet-reachable Microweber CMS instance at or below version 2.0.20 exposing the ServeStaticFileContoller static file route is exploitable by supplying traversal sequences in the ?path= query parameter, which overrides the {path} route segment via Laravel's Request::__get. Exploitation is limited to files readable by the web server OS user and is confidentiality-only (no write or code execution through this flaw); real-world impact depends on sensitive files such as .env residing in a traversable location, which is the default project layout. The main limiting factor is that the target must be running an unpatched build (≤2.0.20) with the vulnerable controller reachable.

This is a genuine, easily exploitable priority rather than a paper-high score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, low-complexity, unauthenticated exploitation with no user interaction, and impact is scoped to high confidentiality only (VC:H, VI:N, VA:N) - consistent with an arbitrary file read that does not directly modify or crash the system. Publicly available exploit code raises real-world likelihood, and the ability to read .env credentials creates a strong secondary escalation path (database, mail, API secrets) even though the vulnerability itself is read-only. No CISA KEV listing or EPSS score was provided, so widespread active exploitation is not confirmed; the combination of trivial exploitation plus a public POC nonetheless warrants prompt remediation. No signals conflict here - description, CWE, source diff, and CVSS vector all agree on unauthenticated remote file disclosure.

An attacker identifies a public Microweber site (≤2.0.20) and issues a single unauthenticated GET request to the static file controller with ?path=../../../../.env (and traversal variants), which normalize_path() fails to sanitize. The response returns the application's environment file, disclosing database, mail, and API credentials that the attacker then reuses to pivot into backend systems. Public exploit code for this technique is available.