Skip to content
OpenAdvisories

Weakness (CWE)

CWE-552: Files or Directories Accessible to External Parties

Base Draft

The product makes files or directories accessible to unauthorized actors, even though they should not be.

More detail

Web servers, FTP servers, and similar servers may store a set of files underneath a "root" directory that is accessible to the server's users. Applications may store sensitive files underneath this root without also using access control to limit which users may request those files, if any. Alternately, an application might package multiple files or directories into an archive file (e.g., ZIP or tar), but the application might not exclude sensitive files that are underneath those directories.

How to prevent it (1 mitigation)

  1. Implementation, System Configuration, Operation

    When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.

Source: MITRE CWE-552

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-21589 Exploited Public exploit EPSS 100%

    This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Sof…

    Atlassian Confluence Data Center Jira Service Management Data Center Bitbucket Data Center Web / CMS
    KEV Oct 15, 2026
  • Critical 9.1
    CVE-2026-37065 Public exploit

    Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&a…

  • Critical 9.1
    CVE-2025-68109 Public exploit

    ChurchCRM vulnerable to RCE with database restore functionality

    ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently uploa…

    ChurchCRM CRM
  • Critical 9.3
    CVE-2025-34110 Public exploit

    ColoradoFTP Server <= 1.3 Build 8 Path Traversal Information Disclosure

    A directory traversal vulnerability exists in ColoradoFTP Server ≤ 1.3 Build 8 for Windows, allowing unauthenticated attackers to read or write arbitrary files outside the configured FTP root directory. The flaw is due to insufficient sanitation of user-suppl…

    ColoradoFTP Server
  • Critical 10.0
    CVE-2024-6209 Public exploit EPSS 17%

    unauthorized file access

    Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access files unauthorized

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • Critical 9.8
    CVE-2023-50164 Public exploit EPSS 81%

    Apache Struts: File upload component had a directory traversal vulnerability

    An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or …

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
  • Critical 9.9
    CVE-2021-43821 Public exploit

    Files Accessible to External Parties in Opencast

    Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and maki…

    opencast opencast org.opencastproject:opencast-ingest-service-impl Maven
  • Critical 9.1
    CVE-2020-17519 Exploited Public exploit EPSS 98%

    Apache Flink directory traversal attack: reading remote files through the REST API

    A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible b…

    Apache Software Foundation Apache Flink org.apache.flink:flink-runtime_2.11 org.apache.flink:flink-runtime_2.12 Maven
    KEV May 23, 2024