CVE-2026-65694: Microweber

High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days.

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalize_path() to strip traversal sequences, disclosing sensitive files such as environment configuration files containing credentials and system files.

Affected products

• Microweber Microweber: up to and including 2.0.20

Published 2026-07-23. Last modified 2026-07-30.