Microweber CMS versions up to 2.0.20 include a path traversal vulnerability in the ServeStaticFileController. The flaw arises because normalize_path() does not strip traversal sequences from the path query parameter, allowing an unauthenticated attacker to supply directory traversal characters. With a single HTTP GET request, the attacker can read arbitrary files on the underlying file system, including sensitive configuration files that may expose credentials or other secrets, as well as other system files.

Any deployed instance of Microweber CMS 2.0.20 is impacted. The vulnerability exists in all releases of that version and earlier that have not been updated to the patched code.

The CVSS base score of 8.7 indicates a high‑severity flaw, and although the EPSS score is moderate at 2%, the exploit is trivial: an unauthenticated JSON GET request can trigger the read. The vulnerability is not currently listed in the CISA KEV catalog. Attackers can target the exposed web interface from the Internet or an internal network, and the lack of authentication means no privilege escalation is required to obtain the disclosed data.