CVE-2026-12198: Microweber path traversal in thumbnail_img API endpoint

CVE-2026-12198 · Severity: high · CVSS 7.3 · Published 2026-06-15

Microweber is a drag-and-drop website builder and CMS platform. The /api_nosession/thumbnail_img endpoint contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files and potentially write files by manipulating the cache_path_relative parameter. This could expose sensitive configuration files, database credentials, or allow attackers to inject malicious code into the application.

Technologies: Microweber, microweber/microweber (Packagist). Vendors: Microweber, Packagist.

Quick answers

Is CVE-2026-12198 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12198 being exploited in the wild.
How severe is CVE-2026-12198?
High severity, with a CVSS score of 7.3, published 15 June 2026.
Which products and versions are affected?
Microweber <= 2.0.20, up to 2.0.20; microweber/microweber (Packagist) <= 2.0.20, ECOSYSTEM:introduced=0,last_affected=2.0.20.
Is there a fix for CVE-2026-12198?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12198 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-12198?
Check whether you run Microweber or microweber/microweber (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a classic path traversal vulnerability (CWE-22) in the thumbnail_img API endpoint. The vulnerable userfiles_path function fails to properly sanitize the cache_path_relative parameter, allowing attackers to use path traversal sequences (e.g., ../) to escape the intended directory and access files outside the intended scope. The vulnerability is located in an unauthenticated API endpoint (/api_nosession/thumbnail_img), making it remotely exploitable without authentication. An attacker can read arbitrary files from the filesystem or, in some cases, write files to controlled locations. The attack requires no user interaction and no special privileges. No patched version has been released, and the vendor did not respond to the early disclosure notification.

Affected products

  • Microweber Microweber <= 2.0.20

Identifiers

  • CVE-2026-12198
  • GHSA-vv4x-qcpq-wgrg

Timeline

  • 2026-06-15: disclosed: Vulnerability published to GitHub Advisory Database
  • 2026-06-15: exploited: Exploit made publicly available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.