CVE-2026-65694 – Microweber CMS 2.0.20 Path Traversal via ServeStaticFileController

CVE ID :CVE-2026-65694

Published : July 23, 2026, 9:20 p.m. | 29 minutes ago

Description :Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalize_path() to strip traversal sequences, disclosing sensitive files such as environment configuration files containing credentials and system files.

Severity: 8.7 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…