PT-2026-49149 · Unknown · Microweber

Tarryhou · Published 2026-06-15 · Updated 2026-06-15 · CVE-2026-12198

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microweber versions prior to 2.0.21

Description A path traversal issue exists in the API Endpoint component. A remote attacker can manipulate the cache path relative argument within the userfiles path() function of the '/api nosession/thumbnail img' endpoint to access files and directories outside the intended folder.

Recommendations Update to version 2.0.21 or later. As a temporary workaround, restrict access to the '/api nosession/thumbnail img' endpoint.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-12198

Affected Products

Microweber

References · 9

• 🔥 https://github.com/whuHouYF/microweber-vuldb-disclosure-2026/blob/991630c494a99c70a96e456992a04de2ecb5a1e1/reports/microweber-path-traversal.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-12198 · Security Note
• https://vuldb.com/vuln/370841/cti · Note
• https://github.com/microweber/microweber/issues/1172 · Note
• https://vuldb.com/submit/829596 · Note
• https://vuldb.com/vuln/370841 · Note
• https://vuldb.com/cve/CVE-2026-12198 · Note
• https://github.com/microweber/microweber · Note
• https://twitter.com/VulmonFeeds/status/2066318798328602757 · Twitter Post