Skip to content
OpenAdvisories

Weakness (CWE)

CWE-219: Storage of File with Sensitive Data Under Web Root

Variant Draft

The product stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.

How to prevent it (2 mitigations)

  1. Implementation, System Configuration

    Avoid storing information under the web root directory.

  2. System Configuration

    Access control permissions should be set to prevent reading/writing of sensitive files inside/outside of the web directory.

Source: MITRE CWE-219

All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Critical 9.8
    CVE-2026-45140 Public exploit

    Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

    Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or e…

    chamilo chamilo-lms chamilo/chamilo-lms Packagist
  • Medium 4.2
    GHSA-xvp7-8vm8-xfxx

    Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers

    ### Summary The GoCardless components in Actualbudget in are logging responses to STDOUT in a parsed format using `console.log`and `console.debug` (Which in this version of node is an alias for `console.log`). This is exposing sensitive information in log fil…

    @actual-app/sync-server npm
  • High 7.8
    CVE-2024-56159

    Server source code is exposed to the public if sourcemaps are enabled

    Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with client assets such as css and font files, the sourcemap files **for the server c…

    withastro astro astro npm
  • High 7.5
    CVE-2024-39776

    Avtec Outpost Storage of File with Sensitive Data Under Web Root

    Avtec Outpost stores sensitive information in an insecure location without proper access controls in place.

    Avtec Outpost 0810 Outpost Uploader Utility
  • Medium 5.3
    CVE-2023-39467

    Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability

    Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not re…

    Triangle MicroWorks SCADA Data Gateway
  • Unscored —
    CVE-2022-36306

    An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS pr…

    Airspan AirVelocity
  • High 8.1
    CVE-2022-21236

    An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136_…

  • Medium 5.3
    CVE-2002-2024

    Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3,…