Description
Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalize_path() to strip traversal sequences, disclosing sensitive files such as environment configuration files containing credentials and system files.
CVSS 7.5EPSS 2.456%Risque 0.92
Voir la source- Publication
- 2026-07-23 22:16:53
- Versions concernées
- <=2.0.20
- Type
- Application web
- Dernière modification
- 2026-07-30 19:56:33
- Vecteur
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N