Executive brief
Microweber, a content management system used for building websites and online stores, contains a security flaw in how it handles requests for static files. An unauthenticated attacker can exploit this to read sensitive files from the server, such as configuration files containing database passwords and encryption keys. This could lead to a full compromise of the website's data and underlying server infrastructure.
Technical details
A path traversal vulnerability exists in the ServeStaticFileController::serveFromUserfiles() method of Microweber CMS. The vulnerability stems from the controller accessing the 'path' property from the request object, which can be overridden by a query parameter, rather than using the intended route segment. Because the normalize_path() function fails to adequately strip directory traversal sequences (e.g., '../'), an unauthenticated attacker can craft a GET request to /userfiles/ with a malicious path parameter to read arbitrary files. This can result in the disclosure of sensitive system files like /etc/passwd or application configuration files like .env, which contain database credentials and application keys. A patch has been proposed in pull request #1181 to use realpath() for canonicalization and verify that the resolved path remains within the intended directory.
Affected products
- Microweber Microweber through 2.0.20
Timeline
- 2026-07-23: disclosed
- 2026-07-23: advisory
- 2026-07-23: patched: Pull request 1181 submitted to address the issue.