MediumPublic exploit

Authenticated arbitrary file read via BackupV2 path traversal/LFI in Microweber CMS

IdentifiersCVE-2025-34076CWE-73

CVE-2025-34076 is an authenticated local file inclusion / arbitrary file read vulnerability in Microweber CMS versions <= 1.2.11. The issue is in the backup management API, specifically the /api/BackupV2/upload and /api/BackupV2/download endpoints. An authenticated user can supply an absolute filesystem path in the src parameter to the upload endpoint. Due to insufficient validation of user-controlled paths and inadequate restrictions in the backup handling logic, the application may operate on that path as if it were a legitimate backup source. The affected file may be relocated or deleted depending on the privileges of the web service account, and the paired download endpoint can then be used to retrieve the file contents. In practice, this allows an authenticated attacker to access arbitrary local files from the underlying server filesystem.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an authenticated attacker to disclose arbitrary local files accessible to the Microweber web service account. This can expose sensitive application data, configuration files, credentials, API keys, database connection strings, environment files, and other host-resident secrets. Because the upload workflow may relocate or delete the targeted file depending on process privileges, exploitation may also cause unintended file modification or availability impact in addition to confidentiality loss.

Mitigation

If you can’t patch tonight, do this now.

Until a fixed release is deployed, restrict or disable access to the /api/BackupV2/upload and /api/BackupV2/download endpoints, especially for non-administrative users. Limit authenticated access to trusted administrators only, place the CMS behind network access controls where possible, and monitor for requests containing absolute paths or unusual src values. Run the web service with the least privileges necessary and ensure the service account cannot read sensitive system files or modify critical paths. Additional hardening such as filesystem permission review, WAF rules for suspicious backup API requests, and audit logging of backup operations can reduce exposure.

Remediation

Patch, then assume compromise.

Upgrade Microweber CMS to a version newer than 1.2.11 that properly validates and constrains backup file operations. The vulnerable backup API should reject absolute paths and any user-supplied path that resolves outside an explicitly allowed backup directory. File operations should be restricted to canonicalized, server-controlled paths only, with strict allowlisting for backup sources and destinations. Review the BackupV2 upload/download implementation to ensure path normalization, symlink-safe handling, and authorization checks are enforced before any filesystem access. If compromise is suspected, rotate credentials and secrets that may have been exposed through arbitrary file read.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

microweber_lfi.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit auxiliary module targeting Microweber CMS v1.2.10 (CVE-2025-34076). The exploit abuses the backup functionality's upload and download endpoints to achieve authenticated Local File Inclusion (LFI), allowing an attacker with valid admin credentials to read arbitrary files from the server's filesystem. The module first authenticates to the CMS, uploads a file (specified by the attacker) to the backup folder, and then downloads it, effectively exfiltrating the file contents. The code is written in Ruby and is structured as a standard Metasploit module, requiring the Metasploit framework to run. The main endpoints targeted are '/admin/login', '/api/user_login', '/api/BackupV2/upload', and '/api/BackupV2/download'. The exploit is operational and requires authenticated access, but does not provide a shell or code execution—its main capability is file disclosure.

Disclosed Jan 30, 2022rubynetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

MicroweberMicroweberapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

4 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity4