CVE-2025-34076
HighCVSS 7.2Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
Microweber CMS versions <= 1.2.11 contain an authenticated local file inclusion vulnerability through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the filesystem by specifying an absolute path in the src parameter, leading to local file disclosure.
Risk Assessment
An attacker could read sensitive files from the server, such as configuration files, credentials, or user data, potentially compromising system confidentiality.
Recommendation
Update Microweber CMS to the latest patched version and restrict API access to trusted users only.
Other vulnerabilities in Microweber CMS
See all- CVE-2014-9464High
In Microweber CMS version 0.95 before 20141209, there is an SQL injection vulnerability in Category.php that allows remote attackers to execute arbitrary SQL commands via the category parameter.
- CVE-2026-67617Medium
Microweber CMS up to version 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system. An authenticated attacker can inject arbitrary JavaScript via the tag_names parameter of the GET /api/save_content_admin endpoint, bypassing three independent sanitization controls. The injected script executes without user interaction for every visitor to the public blog page and within the admin post editor.
- CVE-2026-65693High
Microweber CMS through version 2.0.20 contains a server-side template injection vulnerability. Authenticated administrators can achieve arbitrary OS command execution by injecting Twig expressions into mail templates.
- CVE-2026-65694High
Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller. Unauthenticated attackers can read arbitrary files by supplying directory traversal sequences in the path query parameter.
Original NVD description (English source)
An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By specifying an absolute file path in the src parameter of the upload request, the server may relocate or delete the target file depending on the web service user’s privileges. The corresponding download endpoint can then be used to retrieve the file contents, effectively enabling local file disclosure. This behavior stems from insufficient validation of user-supplied paths and inadequate restrictions on file access and backup logic.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS