CVE-2026-65694

HIGH

Microweber CMS 2.0.20 Path Traversal via ServeStaticFileController

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-65694. PoCs published by abdugafforov-bobur.

AI-analyzed exploit summary This PoC exploits CVE-2026-65694, an unauthenticated path traversal vulnerability in Microweber CMS (≤ 2.0.20) allowing arbitrary file read via the `?path=` query parameter overriding the `{path}` route segment. The exploit bypasses weak path normalization to access files outside the `userfiles/` directory, excluding PHP files.

Description

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalize_path() to strip traversal sequences, disclosing sensitive files such as environment configuration files containing credentials and system files.

Exploits (1)

github WORKING POC
by abdugafforov-bobur · pythonpoc
https://github.com/abdugafforov-bobur/CVE-2026-65694-PoC

This PoC exploits CVE-2026-65694, an unauthenticated path traversal vulnerability in Microweber CMS (≤ 2.0.20) allowing arbitrary file read via the `?path=` query parameter overriding the `{path}` route segment. The exploit bypasses weak path normalization to access files outside the `userfiles/` directory, excluding PHP files.

Classification
Working Poc 99%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Microweber CMS ≤ 2.0.20
No auth needed
Prerequisites: Target must use the default `public/` document root configuration · Web server must route `/userfiles/*` to the Laravel router · Files with .php/.phtml/.php7 extensions are blocked
mistral-large-3 · analyzed Jul 25, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit exploit technical-description patch
Researcher Pull Request
https://github.com/microweber/microweber/pull/1181

Scores

CVSS v3 7.5
EPSS 0.0079
EPSS Percentile 52.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (1)
microweber/microweber < 2.0.20
Published Jul 23, 2026
Tracked Since Jul 24, 2026