CVE-2026-12198

Microweber API Endpoint thumbnail_img userfiles_path path traversal

CVSS 6.9 MEDIUMEPSS 0.5%CWE-22

Vexday Risk Score

33Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS 6.9EPSS 0.5%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

15 Jun 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file /api_nosession/thumbnail_img of the component API Endpoint. Executing a manipulation of the argument cache_path_relative can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

n/a · Microweber

public PoCs found — 1

cve_referencegithub.com/whuHouYF/microweber-vuldb-disclosure-2026/blob/991630c494a99c70a96e456992a04de2ecb5a1e1/reports/microweber-path-traversal.mdunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://github.com/microweber/microweber/https://github.com/microweber/microweber/issues/1172 https://github.com/whuHouYF/microweber-vuldb-disclosure-2026/blob/991630c494a99c70a96e456992a04de2ecb5a1e1/reports/microweber-path-traversal.md https://vuldb.com/cve/CVE-2026-12198 https://vuldb.com/submit/829596 https://vuldb.com/vuln/370841 https://vuldb.com/vuln/370841/cti