CVE-2026-65694: Microweber CMS 2.0.20 Path Traversal via ServeStaticFileController
Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalizepath() to strip traversal sequences, disclosing sensitive files such as environment configuration files containing credentials and system files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65694?
CVE-2026-65694 has a severity rating of high with a score of 7.5.
What vulnerable software is affected by CVE-2026-65694?
CVE-2026-65694 affects Microweber CMS version 2.0.20.
What type of vulnerability is CVE-2026-65694?
CVE-2026-65694 is a path traversal vulnerability.
How do I fix CVE-2026-65694?
To fix CVE-2026-65694, upgrade to a version of Microweber CMS that is patched for this vulnerability.
Can CVE-2026-65694 be exploited by unauthenticated users?
Yes, CVE-2026-65694 can be exploited by unauthenticated remote attackers.