Read the docs
TI-2025-24243 Aliases CVE-2025-34076GHSA-j64v-xh5w-8hqj

Microweber CMS Authenticated Local File Inclusion via Backup API

Priority MEDIUM 60CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By specifying an absolute file path in the src parameter of the upload request, the server may relocate or delete the target file depending on the web service user’s privileges. The corresponding download endpoint can then be used to retrieve the file contents, effectively enabling local file disclosure. This behavior stems from insufficient validation of user-supplied paths and inadequate restrictions on file access and backup logic.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02291 83rd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix Fixed microweber/microweber (Packagist): 1.2.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
microweberCMSup to 1.2.11—No fix listedCNA
—microweber/microweber (Packagist)before 1.2.111.2.11Patch availableGHSA-j64v-xh5w-8hqj
  • CMS Vendormicroweber Affected up to 1.2.11 Fixed in — No fix listed CNA
  • microweber/microweber (Packagist) Vendor— Affected before 1.2.11 Fixed in 1.2.11 Patch available GHSA-j64v-xh5w-8hqj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*up to 1.2.11Vulnerablemicroweber
  • cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:* Versions up to 1.2.11 Vulnerable ·microweber

Remediation

  • Fix · GHSA-j64v-xh5w-8hqj microweber/microweber (Packagist) Fixed in 1.2.11 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34076
  2. 2026-10-03 Alias added: GHSA-j64v-xh5w-8hqj

References

Exploit 2

Patch 2

Advisory 1

Other 1

  • TI-2023-01763 Command Injection in microweber/microweber CVSS 3.1CRITICAL 9.8
  • TI-2023-02100 Improper Privilege Management in microweber/microweber CVSS 3.1HIGH 8.8
  • TI-2022-14518 Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack. CVSS 3.1HIGH 8.8
  • TI-2023-04891 Use of Hard-coded Credentials in microweber/microweber CVSS 3.1HIGH 7.5
  • TI-2025-37870 Microweber CMS 2.0 has Weak Password Requirements. CVSS 3.1HIGH 8.3
  • TI-2022-04247 Cross-site Scripting (XSS) - Stored in microweber/microweber CVSS 3.1MEDIUM 6.1
See all 113 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences