CVE-2026-5695: Multiple vulnerabilities in the Microweber administration panel
Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely (demonstrated by uploading the EICAR test file), which could result in the system being completely compromised.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the Microweber administration panel. The provided information does not identify which authenticated roles have access to the affected upload forms.
What access does an attacker gain by successfully exploiting the upload flaw?
The flaw can allow unrestricted file upload to the server and may enable remote execution of malicious code. Successful exploitation could completely compromise the system.
Are default installations affected?
The available information does not state whether the vulnerable upload forms are enabled or accessible in a default Microweber installation.