CVE-2026-12198

Vulnerability

CVE-2026-12198 describes a path traversal vulnerability in Microweber up to and including version 2.0.20 [1]. The flaw resides in the function userfiles_path accessible through the API endpoint /api_nosession/thumbnail_img. The endpoint does not properly validate the cache_path_relative argument, allowing directory traversal sequences such as ../ to escape the intended thumbnail cache directory. The normalize_path() helper only normalizes separators and does not strip traversal strings [2].

Exploitation

An unauthenticated attacker can send a maliciously crafted GET request to /api_nosession/thumbnail_img with a cache_path_relative parameter containing ../ sequences. For example, to read a file outside the cache path, an attacker could use ?src=userfiles/modules/admin/backup/backup.svg&width=16&height=16&cache_path_relative=../composer.json. The attack is remotely exploitable without any prior authentication or user interaction [2].

Impact

Successful exploitation enables arbitrary file read from the server filesystem. Under certain conditions where the source image is a local SVG file, the endpoint may also write an attacker-controlled file to a path outside the intended thumbnail directory, leading to a path-controlled file write. This could expose sensitive configuration data (e.g., composer.json) and potentially enable further compromise of the system [2].

Mitigation

As of the publication date (2026-06-15), no official patch has been released by Microweber. The vendor was contacted early about this disclosure but did not respond [1][2]. Users of Microweber 2.0.20 and earlier versions should consider restricting access to the /api_nosession/thumbnail_img endpoint via web server rules (e.g., .htaccess or reverse proxy) as a temporary workaround. No fixed version is available at this time [1][2].