Description
Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely (demonstrated by uploading the EICAR test file), which could result in the system being completely compromised.
Published: 2026-09-23
Score: 8.4 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Assess Impact
AI Analysis

Impact

This vulnerability is an arbitrary file upload flaw caused by insufficient validation in the Microweber administration panel’s upload forms. An attacker who can authenticate to the admin area can upload any file type to the server. Test files such as the EICAR test file have been used to demonstrate that upload leads to remote code execution, potentially allowing full compromise of the system.

Affected Systems

The affected product is the Microweber administration panel, specifically version 2.0.19 as identified by the CPE string.

Risk and Exploitability

The CVSS score of 8.4 signifies a high severity level. The exploit probability, according to the EPSS score, is not currently available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires authenticated access to the admin interface, after which the attacker can upload a malicious file that the server will execute, resulting in remote code execution.

Generated by OpenCVE AI on September 23, 2026 at 13:54 UTC.

Remediation

Vendor Solution

There is no reported solution at this time.

OpenCVE Recommended Actions

  • Configure the upload handler to reject all file types except a curated list of safe extensions and MIME types to mitigate the arbitrary upload flaw (CWE-434).
  • Ensure the directories that receive uploaded files are set with non-executable permissions or placed outside the webroot, and enforce "noexec" flags on the filesystem where possible.
  • Implement an input sanitization routine that validates the file name and strips any potentially dangerous characters before storage.

Generated by OpenCVE AI on September 23, 2026 at 13:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Description Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely (demonstrated by uploading the EICAR test file), which could result in the system being completely compromised.
Title Multiple vulnerabilities in the Microweber administration panel
First Time appeared Microweber
Microweber administration Panel
Weaknesses CWE-434
CPEs cpe:2.3:a:microweber:administration_panel:2.0.19:*:*:*:*:*:*:*
Vendors & Products Microweber
Microweber administration Panel
References
Metrics cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Microweber Administration Panel
cve-icon MITRE

Status: PUBLISHED

Assigner: INCIBE

Published:

Updated: 2026-09-23T13:46:32.519Z

Reserved: 2026-04-06T12:33:58.454Z

Link: CVE-2026-5695

cve-icon Vulnrichment

Updated: 2026-09-23T13:46:27.184Z

cve-icon NVD

Status : Received

Published: 2026-09-23T11:17:10.590

Modified: 2026-09-23T14:17:08.080

Link: CVE-2026-5695

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T15:36:53Z

Weaknesses
  • CWE-434

    Unrestricted Upload of File with Dangerous Type