CVE-2026-65694Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalize_path() to strip traversal sequences, disclosing sensitive files such as environment configuration files containing credentials and system files.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-07-30); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

pdnuclei-bot@pdnuclei_bot92d
Disclosure
🚨 CVE-2026-65694 - high 🚨 Microweber CMS <= 2.0.20 - Unauthenticated Arbitrary File Read > Microweber CMS <= 2.0.20 contains a path traversal vulnerability caused by failure to... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-65694 @pdnuclei #NucleiTemplates #cve
Post summary
The post announces a newly disclosed path‑traversal vulnerability in Microweber CMS, providing minimal technical details but no PoC, exploit, patch, or evidence of active exploitation.
00021292
1.3K followersView on X
Halil Deniz@denizhalilT89d
Disclosure
🚨 NEW VULNERABILITY ALERT 🚨 CVE-2026-65694 reveals an Unauthenticated Arbitrary File Read flaw in Microweber CMS <= 2.0.20 via ServeStaticFileController. Remote attackers can extract sensitive files (.env). https://denizhalil.com/2026/08/01/cve-2026-65694-microweber-arbitrary-file-read/ #CVE202665694 #CyberSecurity #InfoSec https://t.co/y8YKWOFXJ3
Post summary
The tweet announces CVE-2026-65694, detailing an unauthenticated arbitrary file read vulnerability in Microweber CMS (≤2.0.20) that allows extraction of .env files, but provides no PoC, exploit, or patch information.
0001063
32 followersView on X

Explore more

Back to dashboard