CVE-2026-12198: Microweber API Endpoint thumbnail_img userfiles_path path traversal
A weakness has been identified in Microweber up to 2.0.20. This affects the function userfilespath of the file /apinosession/thumbnailimg of the component API Endpoint. Executing a manipulation of the argument cachepathrelative can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
microweberfrom your environment.Uninstall Microweber or remove the vulnerable component from affected hosts until an official vendor fix or patch is available.
- Configuration
Disable or remove the /api_nosession/thumbnail_img API endpoint (or disable handling of the cache_path_relative argument) in the application configuration or source code to prevent remote invocation of userfiles_path.
Microweber API Endpoint (/api_nosession/thumbnail_img) endpoint_access = disabled - Compensating control
Block or restrict access to the /api_nosession/thumbnail_img endpoint at the network edge (WAF, reverse proxy, or firewall). Apply rules to deny requests that include the cache_path_relative parameter or that contain path-traversal patterns (e.g., ../).
- Operational
Search logs and monitoring systems for requests to /api_nosession/thumbnail_img and for use of the cache_path_relative argument. Investigate and remediate any signs of exploitation; isolate affected systems and perform incident response as needed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12198?
The severity of CVE-2026-12198 is high with a score of 7.3.
What is the impact of CVE-2026-12198?
CVE-2026-12198 allows attackers to exploit a path traversal vulnerability within the Microweber API Endpoint.
How do I fix CVE-2026-12198?
To fix CVE-2026-12198, update Microweber to version 2.0.21 or later.
What versions of Microweber are affected by CVE-2026-12198?
Microweber versions up to 2.0.20 are affected by CVE-2026-12198.
What type of vulnerability is CVE-2026-12198?
CVE-2026-12198 is classified as a path traversal vulnerability.