CVE-2025-34076 Microweber CMS Authenticated Local File Inclusion via Backup API
Authenticated attackers can read arbitrary files and potentially delete them via the backup API due to insufficient path validation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-34076?
CVE-2025-34076 is a medium-severity path traversal vulnerability in Microweber Microweber, published on 2 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By specifying an absolute file path in the src parameter of the upload request, the server may relocate or delete the target file depending on the web service user’s privileges. The corresponding download endpoint can then be used to retrieve the file contents, effectively enabling local file disclosure. This behavior stems from insufficient validation of user-supplied paths and inadequate restrictions on file access and backup logic.
Weakness: CWE-22
Which versions are affected by CVE-2025-34076?
2 open source packages ship an affected version, including microweber/microweber. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
microweber/microweber Packagist | All versions | 1.2.11 |
microweber/microweber Packagist | All versions | 1.2.11 |
Products include Microweber Microweber.
How do I fix CVE-2025-34076?
Upgrade microweber/microweber to 1.2.11 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-34076 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34076 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Microweber Microweber
- CVE-2022-0558 Cross-site Scripting (XSS) - Stored in microweber/microweber
- CVE-2020-23138 File upload in n/a
- CVE-2022-0688 Business Logic Errors in microweber/microweber
- CVE-2022-0660 Generation of Error Message Containing Sensitive Information in microweber/microweber
- CVE-2022-0913 Integer Overflow or Wraparound in microweber/microweber
Sources
Also known as GHSA-j64v-xh5w-8hqj.