High severity · published Jun 15, 2026
CVE-2026-12198
Microweber API Endpoint thumbnail_img userfiles_path path traversal
7.3
CVSS
0.5%
EPSS
No
On KEV
Description
A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file /api_nosession/thumbnail_img of the component API Endpoint. Executing a manipulation of the argument cache_path_relative can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Microweber · Microweber
2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +15 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12198
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-12198
github.com
https://github.com/microweber/microweber/
github.com
https://github.com/microweber/microweber/issues/1172
github.com
https://github.com/whuHouYF/microweber-vuldb-disclosure-2026/blob/991630c494a99c70a96e456992a04de2ecb5a1e1/reports/microweber-path-traversal.md
vuldb.com
https://vuldb.com/cve/CVE-2026-12198
vuldb.com
https://vuldb.com/submit/829596
vuldb.com
https://vuldb.com/vuln/370841
More from Microweber
9.8
CVE-2023-1877
Command Injection in microweber/microweber
9.8
CVE-2022-2368
Authentication Bypass by Spoofing in microweber/microweber
9.8
CVE-2022-0895
Static Code Injection in microweber/microweber
9.8
CVE-2020-23138
An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page
8.8
CVE-2023-49052
File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component