CVE-2025-34076: Microweber CMS Authenticated Local File Inclusion Vulnerability
Summary
CVE-2025-34076: Microweber CMS API has authenticated local file inclusion vulnerability. Affects microweber/microweber versions < 1.2.11. Fixed in 1.2.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Microweber CMS is an open-source content management system that allows users to create and manage websites with ease. It features a user-friendly interface, drag-and-drop functionality, and a variety of customizable templates. However, versions prior to 1.2.11 are susceptible to an authenticated local file inclusion vulnerability, which can be exploited through its backup management API.
Vulnerability Detail
An authenticated local file inclusion vulnerability exists in Microweber CMS versions prior to 1.2.11 due to improper handling of file paths in the backup management API. This vulnerability allows authenticated users to exploit the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the server's filesystem. By providing an absolute file path in the src parameter of the upload request, attackers can manipulate files based on their privileges, leading to potential data exposure and unauthorized access to sensitive information.
How To Fix
Minimum fixed version
1.2.11
This is the first release that contains the fix.
composer require microweber/microweber:1.2.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the backup management API endpoints for authenticated users until the package is updated. This can be done by modifying the server configuration to limit access based on user roles or permissions.
Conclusion
CVE-2025-34076 represents a significant security risk for users of Microweber CMS versions prior to 1.2.11. It is crucial to update to the latest version to mitigate this risk and protect sensitive data from unauthorized access. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for microweber/microweber →
FAQ
The impact includes potential unauthorized access to sensitive files on the server, leading to data exposure and possible further exploitation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
All versions of Microweber CMS prior to 1.2.11 are affected by this vulnerability.
Yes, a patch is available in version 1.2.11 and later of Microweber CMS.
If an immediate update is not possible, consider implementing access restrictions to the affected API endpoints as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for microweber/microweber.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
