A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows…
Priority MEDIUM 48CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously constructed ZIP file with file paths including relative paths (i.e., ../../), move this file into the backup directory, and execute a restore on this file.
Why it matters now
EPSS 0.16611 97th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed microweber/microweber (Packagist): 1.2.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | microweber/microweber (Packagist) | before 1.2.3 | 1.2.3 | Patch available | GHSA-pqcf-v8v5-jmcg |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- microweber/microweber (Packagist) Vendor— Affected before 1.2.3 Fixed in 1.2.3 Patch available GHSA-pqcf-v8v5-jmcg
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:* | up to 1.1.20 | Vulnerable | microweber |
- cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:* Versions up to 1.1.20 Vulnerable ·microweber
Remediation
- Fix · GHSA-pqcf-v8v5-jmcg microweber/microweber (Packagist) Fixed in 1.2.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-28337
- 2026-10-03 Alias added: GHSA-pqcf-v8v5-jmcg
References
Exploit 2
More Microweber vulnerabilities
- TI-2023-01763 Command Injection in microweber/microweber CVSS 3.1CRITICAL 9.8
- TI-2023-02100 Improper Privilege Management in microweber/microweber CVSS 3.1HIGH 8.8
- TI-2022-14518 Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack. CVSS 3.1HIGH 8.8
- TI-2023-04891 Use of Hard-coded Credentials in microweber/microweber CVSS 3.1HIGH 7.5
- TI-2025-37870 Microweber CMS 2.0 has Weak Password Requirements. CVSS 3.1HIGH 8.3
- TI-2022-04247 Cross-site Scripting (XSS) - Stored in microweber/microweber CVSS 3.1MEDIUM 6.1
Sources
- CVE-2020-28337 · CVE Program
- CVE-2020-28337 · NVD
- FIRST EPSS
- GHSA-pqcf-v8v5-jmcg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences