CVE-2026-12198: Microweber Path Traversal Vulnerability
Summary
CVE-2026-12198: Microweber vulnerable to Path Traversal. Affects microweber/microweber versions < 2.0.20. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Microweber is an open-source content management system (CMS) designed for creating websites and online stores. It offers a user-friendly interface, drag-and-drop functionality, and a variety of themes and modules. However, versions up to 2.0.20 are vulnerable to a path traversal issue that could allow unauthorized access to sensitive files on the server.
Vulnerability Detail
A path traversal vulnerability exists in Microweber versions up to 2.0.20, specifically in the userfiles_path function of the API Endpoint at /api_nosession/thumbnail_img. By manipulating the cache_path_relative argument, an attacker can exploit this vulnerability to access files outside the intended directory. This could lead to unauthorized file disclosure, potentially exposing sensitive information. The vulnerability can be exploited remotely, and public exploits are available, making it crucial for users to address this issue promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you cannot immediately update to the patched version, consider restricting access to the API endpoint or implementing additional server-side validation to prevent unauthorized file access. This can be done by configuring your web server to deny requests that attempt to access sensitive directories.
Conclusion
The path traversal vulnerability in Microweber versions up to 2.0.20 poses a significant risk to users, allowing unauthorized access to sensitive files. It is essential to update to the latest version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in your open-source dependencies.
See every vulnerability recorded for microweber/microweber →
FAQ
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory structure, potentially leading to unauthorized data exposure.
If you are using Microweber version 2.0.20 or earlier, your installation is vulnerable to this issue. You can check your version in the admin dashboard or by inspecting the composer.lock file.
Exploitation of this vulnerability could lead to unauthorized access to sensitive files, which may contain configuration settings, user data, or other critical information.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application against known vulnerabilities using the Vulert playground without any signup.
The CVSS score for this vulnerability is 7.3, indicating a moderate severity level that requires prompt attention.
Related vulnerabilities
Recent vulnerabilities recorded for microweber/microweber.
