CVE-2026-12198 is a path traversal vulnerability affecting Microweber versions 2.0.0 through 2.0.20. The flaw exists in the userfiles_path function within the /api_nosession/thumbnail_img API endpoint, where manipulation of the cache_path_relative parameter can lead to unauthorized file path access. The vulnerability can be exploited remotely without any privileges or user interaction. Although the exploit code is publicly available, the vendor has not issued any response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows remote attackers to perform path traversal attacks, potentially accessing or manipulating files outside the intended directory scope. This can lead to unauthorized disclosure or modification of files on the affected system. The impact is rated medium based on the CVSS 4.0 score of 6.9. There is no indication of privilege escalation or denial of service from the provided data.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the disclosure. Users should monitor the vendor's communications for any future updates or patches. Until a fix is released, restricting access to the vulnerable API endpoint and implementing web application firewall (WAF) rules to detect and block path traversal attempts may help mitigate risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.