Summary
CVE-2026-65694 is a high-severity path traversal vulnerability (CWE-22) in Microweber CMS affecting all versions through 2.0.20. The flaw allows unauthenticated remote attackers to read arbitrary files from the server — including sensitive .env configuration files — by sending a single HTTP GET request. It carries a CVSS 4.0 score of 8.7 (HIGH).
Technical details
- Root cause: The
ServeStaticFileController::serveFromUserfiles()method reads the file path from the$request->pathquery parameter instead of the bound route parameter$request->route('path'). This allows a?path=query string to override the intended route segment. Thenormalize_path()function subsequently fails to strip directory traversal sequences (../), enabling path escape outside the intendeduserfilesdirectory. - Trigger conditions: No authentication, no user interaction, and no special configuration are required. A single crafted HTTP GET request to the static file controller endpoint is sufficient to trigger the vulnerability.
- Attack vector: Unauthenticated remote network access via HTTP GET request containing directory traversal sequences in the
pathquery parameter (e.g.,?path=../../.env). - Impact: Arbitrary file read with high confidentiality impact. Sensitive targets include
.envfiles (exposing database credentials, API keys, and application secrets) and system files. Successful exploitation can serve as a direct stepping stone to full system compromise.
Affected software
- Microweber CMS — all versions through 2.0.20 (inclusive)
Severity
- CVSS 4.0: 8.7 (HIGH) —
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1: 7.5 (HIGH) —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Mitigation and recommended actions
- Patch status: A fix has been proposed in GitHub Pull Request #1181, which updates the controller to use
$request->route('path'), appliesrealpath()canonicalization, and enforces that the resolved path remains within theuserfiles_path()directory. As of the publication of this advisory, the fix has not yet been merged into the main branch and no patched release is available. - Immediate workaround — restrict access at the network perimeter: Where possible, place Microweber instances behind a WAF or reverse proxy configured to block requests containing directory traversal sequences (
../,..%2F,%2e%2e/) in query parameters. - Immediate workaround — limit file system exposure: Ensure the web server process runs under a least-privilege account with read access restricted to application directories only, reducing the scope of files reachable via traversal.
- Monitor: Track the upstream repository for the official patched release and apply it immediately upon availability.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

