PT-2025-27668 · Unknown · Microweber Cms

Talha Karakumru · Published 2025-07-02 · Updated 2025-07-02 · CVE-2025-34076

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Microweber CMS versions <= 1.2.11

Description: An authenticated local file inclusion issue exists due to the misuse of the backup management API. Authenticated users can exploit the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem by specifying an absolute file path in the src parameter of the upload request. This allows for local file disclosure due to insufficient validation of user-supplied paths and inadequate restrictions on file access and backup logic.

Recommendations: For Microweber CMS versions <= 1.2.11, consider disabling the /api/BackupV2/upload and /api/BackupV2/download endpoints until a patch is available to prevent exploitation. Restrict access to the backup management API to minimize the risk of arbitrary file disclosure. Avoid using the src parameter in the upload request to prevent specifying absolute file paths.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-34076

GHSA-J64V-XH5W-8HQJ

Affected Products

Microweber Cms

References · 11

• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/gather/microweber_lfi.rb · Exploit
• 🔥 https://huntr.com/bounties/09218d3f-1f6a-48ae-981c-85e86ad5ed8b · Exploit
• https://github.com/microweber/microweber/commit/572bdc36b5b47923790016f6b961c8df53226855 · Patch
• https://github.com/microweber/microweber/commit/98d025467128ecc24195dcb56c533febc3c91af6 · Patch
• https://osv.dev/vulnerability/CVE-2025-34076 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34076 · Security Note
• https://osv.dev/vulnerability/GHSA-j64v-xh5w-8hqj · Vendor Advisory
• https://github.com/microweber/microweber · Note
• https://twitter.com/VulmonFeeds/status/1940550354346623339 · Twitter Post
• https://vulncheck.com/advisories/microweber-cms-lfi · Note
• https://twitter.com/CVEnew/status/1940495173223370994 · Twitter Post