CVE-2026-12198: Microweber Path Traversal in Thumbnail API Endpoint

Technical summary

CVE-2026-12198 is a CWE-22 path traversal vulnerability in Microweber's /api_nosession/thumbnail_img API endpoint. The userfiles_path function fails to properly validate or sanitize the cache_path_relative parameter, allowing an attacker to inject directory traversal sequences (e.g., ../) to escape the intended base directory. The API endpoint is accessible without session authentication, eliminating a potential protective boundary. The CVSS 3.1 score of 7.3 reflects network accessibility, low attack complexity, and the ability to impact confidentiality, integrity, and availability.

Business impact

Organizations using Microweber for content management or e-commerce face exposure of confidential files (customer data, configuration files, database credentials), unauthorized modification of website content, and potential deployment of malware through file write capabilities. The lack of vendor response compounds operational risk, as patches may be delayed or unavailable. Service disruption is possible if critical files are overwritten. For hosting providers or agencies managing multiple Microweber instances, the remote, unauthenticated attack vector and public exploit code significantly elevate incident likelihood.

Affected systems

Microweber versions up to and including 2.0.20 are affected. The vulnerability exists in the API endpoint /api_nosession/thumbnail_img, which is likely enabled by default. Any deployment of the affected version is at risk if the endpoint is accessible from the network. Verify your Microweber installation version in the admin panel or by checking version.php/version-related configuration files.

Exploitability

The vulnerability is highly exploitable: no authentication is required, attack complexity is low, and network access is sufficient to trigger the flaw. Public exploit code is available, dramatically lowering the barrier to exploitation by opportunistic attackers and automated scanning tools. Active exploitation is likely already occurring, especially against internet-facing instances. The three-month window between publication (June 2026) and now represents significant exposure time.

Remediation

Upgrade Microweber to the latest available version beyond 2.0.20. Verify with the vendor's release notes or advisory that the path traversal in the /api_nosession/thumbnail_img endpoint is addressed. If an immediate upgrade is not feasible, disable or restrict access to the /api_nosession/thumbnail_img endpoint at the web application firewall or reverse proxy level using IP allowlisting or authentication middleware. Additionally, review recent access logs for suspicious requests containing ../sequences or unusual cache_path_relative values.

Patch guidance

Contact Microweber directly or check their official GitHub repository and release page for patched versions newer than 2.0.20. Test patches in a staging environment before production deployment to ensure compatibility with custom modules or themes. If the vendor has not yet released a patch, implement network-level mitigations (WAF rules blocking path traversal payloads) and monitor for exploitation attempts. Keep systems updated as new releases become available.

Detection guidance

Monitor web server and application logs for requests to /api_nosession/thumbnail_img containing path traversal patterns such as ../, %2e%2e%2f (URL-encoded variants), or ..\\. Alert on any cache_path_relative parameter containing sequences outside the expected filename format. Implement WAF rules to block directory traversal signatures. Review filesystem access logs for unexpected file reads or writes in sensitive directories (config, database, admin areas). Network-based intrusion detection rules for CVE-2026-12198 should trigger on crafted thumbnail_img requests with traversal payloads.

Why prioritize this

This vulnerability merits immediate attention due to the convergence of high severity (CVSS 7.3), public exploit availability, lack of vendor response, remote unauthenticated exploitability, and confirmed real-world risk. It is not yet in the CISA KEV catalog but should be treated with equal urgency given the public proof-of-concept and three-month exposure window. Organizations running Microweber should prioritize patching or mitigation within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction needed (UI:N), and impact to confidentiality, integrity, and availability within the vulnerable scope (C:L, I:L, A:L). The score does not account for public exploit availability or lack of vendor responsiveness, both of which increase real-world risk beyond the base metric. Organizations should treat this as functionally critical in their threat landscape.

Frequently asked questions