Microweber versions up to 2.0.20 contain a flaw in the /api_nosession/thumbnail_img endpoint. The cache_path_relative parameter can be manipulated to include directory traversal characters, resulting in a path traversal vulnerability (CWE‑22). The CVE description indicates that the attack can be launched remotely and that a public exploit is available, suggesting that the flaw could be leveraged for further attacks.

The issue affects the Microweber CMS up to release 2.0.20. All versions older than or equal to this release are potentially vulnerable; newer releases have not been publicly identified as affected. The vulnerability resides in the Microweber component served at /api_nosession/thumbnail_img.

The CVSS score of 6.9 denotes moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be triggered remotely by invoking the API endpoint without authentication. A publicly available exploit exists, meaning that exposed endpoints could be abused until remedied.