Executive brief
Microweber is a drag-and-drop website builder and CMS platform. The /api_nosession/thumbnail_img endpoint contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files and potentially write files by manipulating the cache_path_relative parameter. This could expose sensitive configuration files, database credentials, or allow attackers to inject malicious code into the application.
Technical details
This is a classic path traversal vulnerability (CWE-22) in the thumbnail_img API endpoint. The vulnerable userfiles_path function fails to properly sanitize the cache_path_relative parameter, allowing attackers to use path traversal sequences (e.g., ../) to escape the intended directory and access files outside the intended scope. The vulnerability is located in an unauthenticated API endpoint (/api_nosession/thumbnail_img), making it remotely exploitable without authentication. An attacker can read arbitrary files from the filesystem or, in some cases, write files to controlled locations. The attack requires no user interaction and no special privileges. No patched version has been released, and the vendor did not respond to the early disclosure notification.
Affected products
- Microweber Microweber <= 2.0.20
Timeline
- 2026-06-15: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-06-15: exploited: Exploit made publicly available
References
- https://github.com/microweber/microweber/issues/1172
- https://github.com/microweber/microweber
- https://github.com/whuHouYF/microweber-vuldb-disclosure-2026/blob/991630c494a99c70a96e456992a04de2ecb5a1e1/reports/microweber-path-traversal.md
- https://vuldb.com/cve/CVE-2026-12198
- https://vuldb.com/submit/829596