CVE-2026-65694

Received Received - Intake

Path Traversal in Microweber CMS

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalize_path() to strip traversal sequences, disclosing sensitive files such as environment configuration files containing credentials and system files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-23

Generated

2026-07-24

AI Q&A

2026-07-24

EPSS Evaluated

N/A

NVD

CVE-2026-65694

Affected Vendors & Products

Vendor	Product	Version / Range
microweber	microweber	to 2.0.20 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Microweber CMS version 2.0.20 has a path traversal vulnerability in its static file controller. This flaw allows unauthenticated attackers to read arbitrary files on the server by sending a specially crafted HTTP GET request with directory traversal sequences in the path parameter. The normalize_path() function fails to properly remove these sequences, enabling access to sensitive files like configuration files containing credentials.

Detection Guidance

Check for unauthenticated HTTP GET requests with directory traversal sequences in the path parameter. Test with URLs like GET /path?path=../../../../etc/passwd or similar traversal patterns targeting sensitive files.

Impact Analysis

This vulnerability allows attackers to access sensitive files on your server without authentication. They could steal credentials, read configuration files, or access other confidential data. Since it requires no user interaction or privileges, it poses a high risk to systems running vulnerable versions of Microweber CMS.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection. Organizations may face compliance violations, legal penalties, and reputational damage if exploited. Proper mitigation is essential to maintain regulatory compliance.

Mitigation Strategies

Update Microweber CMS to the latest version beyond 2.0.20. If an update is not immediately available, restrict access to the static file controller via web server rules or firewall. Review server logs for suspicious GET requests with traversal sequences.

Hi! I’m here to help you understand CVE-2026-65694. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70