PT-2026-64188 · Microweber · Microweber

Bobur Abdugafforov · CVE-2026-65694 · Publicado 2026-07-23 · Atualizado 2026-07-23

NVD

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalize path() to strip traversal sequences, disclosing sensitive files such as environment configuration files containing credentials and system files.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-65694

Produtos afetados

Microweber

Referências · 3

• 🔥 https://github.com/microweber/microweber/pull/1181 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-65694 · Nota de Segurança
• https://vulncheck.com/advisories/microweber-cms-path-traversal-via-servestaticfilecontroller · Nota