Weakness (CWE)
CWE-552: Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
More detail
Web servers, FTP servers, and similar servers may store a set of files underneath a "root" directory that is accessible to the server's users. Applications may store sensitive files underneath this root without also using access control to limit which users may request those files, if any. Alternately, an application might package multiple files or directories into an archive file (e.g., ZIP or tar), but the application might not exclude sensitive files that are underneath those directories.
How to prevent it (1 mitigation)
-
Implementation, System Configuration, Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
Source: MITRE CWE-552
27 results · Clear filters · Feed
-
Critical 9.3
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Sof…
KEV Oct 15, 2026 -
Critical 9.1CVE-2026-37065 Public exploit
Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&a…
-
Medium 6.5CVE-2026-40564 Public exploit
Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator
Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a u…
-
High 7.5CVE-2025-69428 Public exploit
An issue in Pro-Bit before v1.77.4 allows unauthenticated attackers to directly access sensitive directory and its subd…
-
Medium 6.5CVE-2025-66955 Public exploit
Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated…
-
Critical 9.1CVE-2025-68109 Public exploit
ChurchCRM vulnerable to RCE with database restore functionality
ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently uploa…
-
High 7.5
Gladinet CentreStack and TrioFox Local File Inclusion Flaw
In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This…
KEV Nov 4, 2025 -
High 8.7CVE-2009-10005 Public exploit
ContentKeeper Web Appliance < 125.10 Arbitrary File Access via mimencode
ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 expose the mimencode binary via a CGI endpoint, allowing unauthenticated attackers to retrieve arbitrary files from the filesystem. By crafting a POST request to /cgi-bin…
-
Critical 9.3CVE-2025-34110 Public exploit
ColoradoFTP Server <= 1.3 Build 8 Path Traversal Information Disclosure
A directory traversal vulnerability exists in ColoradoFTP Server ≤ 1.3 Build 8 for Windows, allowing unauthenticated attackers to read or write arbitrary files outside the configured FTP root directory. The flaw is due to insufficient sanitation of user-suppl…
-
Critical 10.0
unauthorized file access
Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access files unauthorized
-
Critical 9.8
Apache Struts: File upload component had a directory traversal vulnerability
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or …
-
Unscored —CVE-2023-34834 Public exploit
A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attacke…
-
Unscored —CVE-2023-36664 Public exploit
Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | p…
-
High 7.5
Dolibarr vulnerable to unauthenticated database access
An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.
-
High 7.5CVE-2023-25260 Public exploit
Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local File Inclusion.
-
High 7.8CVE-2022-40126 Public exploit
A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate priv…
-
High 7.5CVE-2022-41343 Public exploit
Dompdf allows remote file inclusion because URI validation failure does not halt font registration
registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.
-
High 7.5
Files or Directories Accessible to External Parties in Adminer
Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.
-
Critical 9.9CVE-2021-43821 Public exploit
Files Accessible to External Parties in Opencast
Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and maki…
-
High 8.8CVE-2021-25741 Public exploit
Symlink Exchange Can Allow Host Filesystem Access
A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.
-
High 7.5
ZoomSounds <= 6.45 Unauthenticated Directory Traversal and Sensitive Information Dislosure
The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action using directory traversal in the `link` parameter.
-
Unscored —CVE-2021-20253 Public exploit
A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker …
-
Critical 9.1
Apache Flink directory traversal attack: reading remote files through the REST API
A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible b…
KEV May 23, 2024 -
High 7.4
Unauthenticated File Deletion in GLPI
In GLPI before version 9.5.2, the `pluginimage.send.php` endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the …
-
High 7.5CVE-2019-17221 Public exploit
PhantomJS Arbitrary File Read
PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open() function of the webpage module, which loads a specified URL and calls a given callback. An at…
-
High 7.8
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary fil…
KEV Nov 3, 2021 -
Medium 5.5
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary f…
KEV Nov 3, 2021