CVE-2022-0666: CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in microweber/microweber

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 44.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-18 · updated 2026-06-17
Weakness: CWE-93

Description

CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.

Affected products

microweber/microweber: before 1.2.11 — fixed in 1.2.11

How to fix

Upgrade to a fixed version: microweber/microweber 1.2.11. Check the vendor advisory for mitigations.

References

https://github.com/microweber/microweber/commit/f0e338f1b7dc5ec9d99231f4ed3fa6245a5eb128
https://huntr.dev/bounties/7215afc7-9133-4749-8e8e-0569317dbd55
https://github.com/microweber/microweber/commit/f0e338f1b7dc5ec9d99231f4ed3fa6245a5eb128
https://huntr.dev/bounties/7215afc7-9133-4749-8e8e-0569317dbd55

Get alerted when CVE-2022-0666 or the next vulnerability affects your stack