Query-String-Override

Microweber CMS Unauthenticated Path Traversal → Arbitrary File Read (CVE-2026-65694)

Microweber CMS exposes an unauthenticated GET /userfiles/{path} route intended to serve files from its userfiles/ upload directory. The controller reads the path via $request->path — a Laravel magic-property accessor that falls back to the request's…