Path Traversal in Microweber API Thumbnail Cache Parameter

A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file /api_nosession/thumbnail_img of the component API Endpoint. Executing a manipulation of the argument cache_path_relative can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-12198 is a path traversal vulnerability affecting Microweber versions up to 2.0.20 in the API endpoint /api_nosession/thumbnail_img. By manipulating the cache_path_relative parameter, an unauthenticated attacker can traverse the file system and access files outside the intended directory. This vulnerability matters because it enables unauthorized file access on web servers running vulnerable Microweber installations—potentially exposing sensitive configuration files, credentials, or private data. Any organization using Microweber as a content management system or website builder is at risk, particularly those that haven't patched beyond version 2.0.20. The attack requires no authentication and is remotely exploitable, making it accessible to a broad threat landscape.

Casky.ai's 331 mapped security skills detect the attack patterns underlying this vulnerability by analyzing behaviors tied to MITRE ATT&CK TA0001 (Initial Access) and TA0007 (Discovery). Practitioners using Casky would observe detection patterns for path traversal attempts—such as suspicious use of directory traversal sequences (.., /, backslashes) in the cache_path_relative parameter—alongside reconnaissance activities targeting API endpoints. Claude's extended reasoning capabilities enable Casky to correlate multiple weak signals: unauthenticated API calls to the thumbnail endpoint, unusual file system access patterns through the userfiles_path function, and attempts to read files outside expected directories. In the findings dashboard, a practitioner would see flagged HTTP requests with malformed cache_path_relative values, file system access anomalies, and behavioral chains indicating discovery and data exfiltration attempts—providing early warning before sensitive files are compromised.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-12198.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-ios-app-security-with-objection

mobile security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-12198

Casky has 331 skills that investigate the attack patterns behind CVE-2026-12198. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn