Skip to content
Threat Feed
Subscribe

Product

Microweber CMS ≤ 2.0.20 and Current Master

1 brief RSS
high advisory

Microweber CMS Path Traversal Vulnerability (CVE-2026-65694)

An unauthenticated path traversal vulnerability (CVE-2026-65694) in the static file controller of Microweber CMS, affecting versions through 2.0.20, allows remote attackers to read arbitrary files by supplying directory traversal sequences in the 'path' query parameter via a single unauthenticated HTTP GET request, potentially disclosing sensitive information like environment configuration files containing credentials or system files.

PoC Microweber CMS +1 web-vulnerability path-traversal cms webserver
1r 2t 1c 2i updated