CVE-2026-65694 — Microweber CMS 2.0.20 Path Traversal via ServeStaticFileController
Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by suppl…
Published: 2026-07-23 · CVSS: 8.7 · CVSS 4.0
Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalize_path() to strip traversal sequences, disclosing sensitive files such as environment configuration files containing credentials and system files.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7