CVE-2026-65694
HIGHMicroweber CMS 2.0.20 Path Traversal via ServeStaticFileController
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2026-65694. PoCs published by abdugafforov-bobur.
AI-analyzed exploit summary This PoC exploits CVE-2026-65694, an unauthenticated path traversal vulnerability in Microweber CMS (≤ 2.0.20) allowing arbitrary file read via the `?path=` query parameter overriding the `{path}` route segment. The exploit bypasses weak path normalization to access files outside the `userfiles/` directory, excluding PHP files.
Description
Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalize_path() to strip traversal sequences, disclosing sensitive files such as environment configuration files containing credentials and system files.
Exploits (1)
This PoC exploits CVE-2026-65694, an unauthenticated path traversal vulnerability in Microweber CMS (≤ 2.0.20) allowing arbitrary file read via the `?path=` query parameter overriding the `{path}` route segment. The exploit bypasses weak path normalization to access files outside the `userfiles/` directory, excluding PHP files.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N