CVE-2025-34076

An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By specifying an absolute file path in the src parameter of the upload request, the server may relocate or delete the target file depending on the web service user’s privileges. The corresponding download endpoint can then be used to retrieve the file contents, effectively enabling local file disclosure. This behavior stems from insufficient validation of user-supplied paths and inadequate restrictions on file access and backup logic.

• CWE-22

• https://github.com/microweber/microweberProduct
• https://github.com/microweber/microweber/commit/572bdc36b5b47923790016f6b961c8df53226855Patch
• https://github.com/microweber/microweber/commit/98d025467128ecc24195dcb56c533febc3c91af6Patch
• https://huntr.com/bounties/09218d3f-1f6a-48ae-981c-85e86ad5ed8bExploit, Third Party Advisory
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/gather/microweber_lfi.rbExploit
• https://vulncheck.com/advisories/microweber-cms-lfiThird Party Advisory
• https://huntr.com/bounties/09218d3f-1f6a-48ae-981c-85e86ad5ed8bExploit, Third Party Advisory

Published

Jul 2, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-34070A missing authentication vulnerability in the GFIAgent compo…9.8
• CVE-2025-34071A remote code execution vulnerability in GFI Kerio Control 9…9.8
• CVE-2025-34072A data exfiltration vulnerability exists in Anthropic’s depr…9.3
• CVE-2025-34073An unauthenticated command injection vulnerability exists in…10
• CVE-2025-34074An authenticated remote code execution vulnerability exists …9.4
• CVE-2025-34075Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-34077An authentication bypass vulnerability exists in the WordPre…10
• CVE-2025-34078A local privilege escalation vulnerability exists in NSClien…7.8
• CVE-2025-34079An authenticated remote code execution vulnerability exists …7.8
• CVE-2025-3408A vulnerability was found in Nothings stb up to f056911. It …8.8
• CVE-2025-34080The Contec Co.,Ltd. CONPROSYS HMI System (CHS) is vulnerable…6.1
• CVE-2025-34081The Contec Co.,Ltd. CONPROSYS HMI System (CHS) exposes a PHP…7.5