Vulnerability · Published Jul 23, 2026 · Assigned by VulnCheck

CVE-2026-65694Microweber CMS 2.0.20 Path Traversal via ServeStaticFileController

High 7.5

In plain English

A high-severity path traversal in microweber from microweber. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)3.4%top 11.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling2Nuclei, Public PoC

Official description

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalize_path() to strip traversal sequences, disclosing sensitive files such as environment configuration files containing credentials and system files.

Affected products (as reported)

Vendor	Product	Versions
microweber	microweber	0 – through 2.0.20

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Researcher Pull Request exploit, technical-description, patch
https://www.vulncheck.com/advisories/microweber-cms-path-traversal-via-servestaticfilecontroller third-party-advisory