Microweber

An authenticated administrator in Microweber CMS through version 2.0.20 is vulnerable to server-side template injection due to an unsandboxed Twig environment, allowing for arbitrary OS command execution by injecting malicious Twig expressions into mail templates, which are executed automatically upon mail dispatch and can compromise the underlying server.

An unauthenticated path traversal vulnerability (CVE-2026-65694) in the static file controller of Microweber CMS, affecting versions through 2.0.20, allows remote attackers to read arbitrary files by supplying directory traversal sequences in the 'path' query parameter via a single unauthenticated HTTP GET request, potentially disclosing sensitive information like environment configuration files containing credentials or system files.