CyberRota Analysis
AI-GeneratedMicroweber CMS versions up to 2.0.20 are vulnerable to a path traversal flaw in the static file controller, enabling unauthenticated remote attackers to read arbitrary files by manipulating the path query parameter. This vulnerability can lead to the exposure of sensitive information, including configuration files with credentials. Organizations using this CMS should prioritize patching to mitigate the risk of unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalize_path() to strip traversal sequences, disclosing sensitive files such as environment configuration files containing credentials and system files.