CVE-2026-65694
HighCVSS 7.5Exploitation Probability (EPSS)
High risk83th percentile - higher than 83% of all known CVEs
Summary
Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller. Unauthenticated attackers can read arbitrary files by supplying directory traversal sequences in the path query parameter.
Risk Assessment
Attackers can disclose sensitive files such as environment configuration files containing credentials and system files.
Recommendation
Update Microweber CMS to a version above 2.0.20 that fixes the path traversal vulnerability.
Other vulnerabilities in Microweber CMS
See all- CVE-2014-9464High
In Microweber CMS version 0.95 before 20141209, there is an SQL injection vulnerability in Category.php that allows remote attackers to execute arbitrary SQL commands via the category parameter.
- CVE-2026-67617Medium
Microweber CMS up to version 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system. An authenticated attacker can inject arbitrary JavaScript via the tag_names parameter of the GET /api/save_content_admin endpoint, bypassing three independent sanitization controls. The injected script executes without user interaction for every visitor to the public blog page and within the admin post editor.
- CVE-2026-65693High
Microweber CMS through version 2.0.20 contains a server-side template injection vulnerability. Authenticated administrators can achieve arbitrary OS command execution by injecting Twig expressions into mail templates.
Original NVD description (English source)
Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalize_path() to strip traversal sequences, disclosing sensitive files such as environment configuration files containing credentials and system files.