Microweber CMS - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/microweber-cms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 23 Jul 2026 22:25:27 +0000Microweber CMS Path Traversal Vulnerability (CVE-2026-65694)https://feed.craftedsignal.io/briefs/2026-07-microweber-path-traversal/Thu, 23 Jul 2026 22:25:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-microweber-path-traversal/An unauthenticated path traversal vulnerability (CVE-2026-65694) in the static file controller of Microweber CMS, affecting versions through 2.0.20, allows remote attackers to read arbitrary files by supplying directory traversal sequences in the 'path' query parameter via a single unauthenticated HTTP GET request, potentially disclosing sensitive information like environment configuration files containing credentials or system files.A critical path traversal vulnerability, tracked as CVE-2026-65694, has been identified in Microweber CMS versions up to and including 2.0.20. This flaw resides within the static file controller, specifically due to the normalize_path() function's failure to properly sanitize or strip directory traversal sequences provided in the path query parameter of HTTP GET requests. Unauthenticated remote attackers can leverage this vulnerability to bypass intended access controls and read arbitrary files on the server. Exploitation requires only a single unauthenticated HTTP GET request, making it highly accessible to attackers. Successful exploitation can lead to the disclosure of sensitive data, such as environment configuration files that often contain database credentials, API keys, or other confidential information, as well as critical system files. This poses a significant risk for data breaches and further system compromise.

Attack Chain

  1. Attacker identifies a vulnerable Microweber CMS instance (version 2.0.20 or earlier).
  2. Attacker crafts a malicious HTTP GET request targeting a web endpoint associated with the static file controller.
  3. The request includes a specially crafted path query parameter containing directory traversal sequences (e.g., ../../) to navigate outside the intended directory.
  4. The vulnerable normalize_path() function within the CMS fails to properly remove these traversal sequences.
  5. The server processes the request, mistakenly resolving the path to an arbitrary file on the underlying operating system.
  6. The web server retrieves the content of the specified arbitrary file, such as /etc/passwd, /etc/shadow, or environment configuration files (.env).
  7. The server includes the sensitive file's content in the HTTP response body to the attacker.
  8. The attacker successfully exfiltrates sensitive information, potentially leading to credential compromise or further system access.

Impact

Successful exploitation of CVE-2026-65694 allows unauthenticated attackers to read any file accessible to the web server process. This directly leads to the disclosure of sensitive information such as database credentials, API keys, private configuration data, and system files. The impact could range from unauthorized access to sensitive application data to full system compromise if credentials for higher-privileged services are exposed. While no specific victim count or sectors are mentioned, any organization utilizing Microweber CMS versions affected by this vulnerability is at risk. Data breaches, intellectual property theft, and subsequent lateral movement or persistent access are potential consequences.

Recommendation

  • Patch CVE-2026-65694 immediately by upgrading Microweber CMS to a version beyond 2.0.20 that addresses this vulnerability.
  • Deploy the Sigma rule "Detects CVE-2026-65694 Exploitation - Microweber Path Traversal" to your SIEM to identify attempted exploitation.
  • Ensure web server logs (logsource category webserver) are collected and ingested into your SIEM for effective detection.
  • Implement web application firewall (WAF) rules to block HTTP GET requests containing directory traversal sequences (../, %2e%2e%2f, etc.) in query parameters, particularly those associated with static file handlers.
]]>highadvisoryweb-vulnerabilitypath-traversalcmswebserver