Microweber Administration Panel EUVD-2026-85219

Exploitation requires an authenticated account with high privileges in the Microweber administration panel (PR:H) - the vulnerable upload forms are administrative features, not public-facing. The core condition is that the upload forms perform no proper validation of uploaded file type/content, allowing unrestricted files (including executable server-side scripts). Limiting factors: the attacker must already hold administrator-level access, the CVSS vector indicates active user interaction (UI:A) may be involved, and no specific fixed/affected version is published (CPE wildcard), so operators cannot yet scope patched builds precisely.

The CVSS 4.0 score of 8.4 (HIGH) is driven by full technical impact (VC:H/VI:H/VA:H - arbitrary code execution and total system compromise) over a network vector with low complexity. However, the score is meaningfully tempered by PR:H, meaning the attacker must already hold high (administrator) privileges in the Microweber administration panel, and UI:A indicating active interaction is expected. This is therefore a post-authentication privilege-to-RCE escalation, not a pre-auth mass-exploitable flaw. No EPSS score, no CISA KEV listing, and no public exploit code were provided - only an EICAR test-file demonstration by the reporter (INCIBE), which proves the upload restriction can be bypassed but is not a weaponized exploit. Real-world priority is moderate: an admin who can upload files can already do significant damage in most CMS platforms, so the marginal risk is lower than the 8.4 suggests. Note the UI:A metric is questionable for an attacker performing their own upload; verify with the vendor whether victim interaction is genuinely required.

An attacker who has obtained authenticated high-privilege access to the Microweber administration panel (via stolen/weak admin credentials or a compromised admin account) submits a malicious file through an upload form that lacks proper validation. Because file type/content is not restricted, the attacker uploads a server-side script (the flaw was demonstrated with the EICAR test file) and then requests it to achieve remote code execution and full system compromise. No public weaponized exploit is identified - only a reporter proof-of-concept using EICAR.