CVE-2026-12198
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
In Microweber up to 2.0.20, a path traversal vulnerability exists in the userfiles_path function of /api_nosession/thumbnail_img via manipulation of the cache_path_relative argument. The attack can be launched remotely and the exploit is publicly available.
Risk Assessment
The organization is at risk of remote arbitrary file read on the server, potentially leading to sensitive data leakage or further attack escalation.
Recommendation
Immediately update Microweber to a version above 2.0.20 and implement path validation in the API.
Other vulnerabilities in Microweber
See all- CVE-2024-40101Medium
A reflected XSS vulnerability exists in Microweber 2.0.15 and earlier in the '/search' endpoint. An unauthenticated remote attacker can inject arbitrary web script or HTML via the 'keywords' parameter.
- CVE-2020-23136Medium
A vulnerability in Microweber v1.1.18 causes the user session not to expire after logout. This allows an attacker to reuse a valid session for unauthorized access.
Original NVD description (English source)
A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file /api_nosession/thumbnail_img of the component API Endpoint. Executing a manipulation of the argument cache_path_relative can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.