Weakness (CWE)
CWE-552: Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
More detail
Web servers, FTP servers, and similar servers may store a set of files underneath a "root" directory that is accessible to the server's users. Applications may store sensitive files underneath this root without also using access control to limit which users may request those files, if any. Alternately, an application might package multiple files or directories into an archive file (e.g., ZIP or tar), but the application might not exclude sensitive files that are underneath those directories.
How to prevent it (1 mitigation)
-
Implementation, System Configuration, Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
Source: MITRE CWE-552
192 results · Clear filters · Feed
-
Medium 5.3
WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /files
WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount. Attackers can enumerate Unix timestamps in GET /files/file<timestamp>.webp…
-
Medium 5.5
Apache OpenOffice: Local file inclusion via SQL provider and flat file database references
The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
-
Medium 5.3
An Otter Wiki 2.20.1 before 2.26.2 Repository File Disclosure via DataTable src
An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an…
-
Medium 6.3
Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader
Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that sepa…
-
Medium 4.8
Nuxt dev server exposes generated appSecret through Vite file serving
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret, within a directory allowed by Vite's server.fs configuration. A client with direc…
-
Medium 5.9
Nuxt dev server exposes private runtime config through the Nitro dev bundle
Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at <buildDir>/dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inli…
-
Medium 4.9
Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability
This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role.
-
Medium 5.9
Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, …
-
Medium 6.5
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An atta…
-
Medium 5.3
satya-vinay Events-Management-System project.sql file access
A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unknown part of the file project.sql. Executing a manipulation can lead to files or directories accessible. The attack may b…
-
Medium 5.5
Windows Projected File System Information Disclosure Vulnerability
Files or directories accessible to external parties in Windows Projected File System allows an authorized attacker to disclose information locally.
-
Medium 6.5
WebDAV Information Disclosure Vulnerability
Files or directories accessible to external parties in WebDAV allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Windows Event Viewer Information Disclosure Vulnerability
Files or directories accessible to external parties in Windows Event Viewer allows an authorized attacker to disclose information over a network.
-
Medium 5.5
Windows Bind Filter Driver Information Disclosure Vulnerability
Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally.
-
Medium 6.3
TYPO3 CMS - Security Misconfiguration in Form Framework
Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessib…
-
Medium 5.3
Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Availability of the appl…
-
Medium 5.3
code-projects Matrimonial System matrimony.sql file access
A flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown processing of the file db/matrimony.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been publis…
-
Medium 5.3
Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the get_file_path. This makes it possible for unauthenticated attackers to extract download ex…
-
Medium 5.9
Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_b…
-
Medium 5.3
An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contain…
-
Medium 5.3
Apache HTTP Server: mod_dav_fs property database read access
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DA…
-
Medium 5.7
Contrast before 1.12.1 Insecure LUKS2 Persistent Storage
Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host supplying a crafted LUKS2 volume to a pod VM. LUKS2 volume metadata is not authenticated and, with …
-
Medium 6.2
Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of sensitive or unnecessary files and increased attack surface.
-
Medium 6.2
Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive information due to recursive copying of build context directories into container images.
-
Medium 5.5
Windows Defender Firewall Service Information Disclosure Vulnerability
Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose information locally.
-
Medium 6.8
Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback
The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the res…
-
Medium 6.5
An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 all…
-
Medium 5.3
Unauthenticated Limited Information Disclosure leads to Data Exposure in HPE Networking Fabric Composer
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files. Successful exploitation could allow an attacker to read files within the affected directory.
-
Medium 5.4
Authenticated Access Control Vulnerabilities allow Information Disclosure in HPE Networking Fabric Composer API
Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access some information beyond their privilege level. Successful exploitation could allow an attacker to obtain limited information and/or…
-
Medium 6.8
Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool
Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Att…
-
Medium 5.3
alexta69 MeTube Cookie File cookies.txt file access
A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the file /download/.metube/cookies.txt of the component Cookie File Handler. This manipulation causes files or directories accessible. The attac…
-
Medium 6.8
Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include t…
-
Medium 5.3
code-projects Login Registration System SQL Database Backup login_registration_system.sql file access
A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the file /loginsystem/database/login_registration_system.sql of the component SQL Database Backup Handler. This manipulation causes files or dir…
-
Medium 5.3
SourceCodester Best Employee Management System Profile exposure of information through directory listing
A security vulnerability has been detected in SourceCodester Best Employee Management System 1.0. This affects an unknown function of the file /assets/uploadImage/Profile/. Such manipulation leads to exposure of information through directory listing. It is po…
-
Medium 5.3
SourceCodester Online Clothing Store SQL Database Backup shopping.sql file access
A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to files or directories accessible. Remote exploitation of the a…
-
Medium 6.5
CVE-2026-15342
Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The…
-
Medium 5.3
agentejo Cockpit CMS htaccess config.yaml YAMLLoad file access
A security vulnerability has been detected in agentejo Cockpit CMS up to 0.12.2. Affected by this issue is the function Spyc::YAMLLoad of the file /config/config.yaml of the component htaccess Handler. Such manipulation leads to files or directories accessibl…
-
Medium 5.3
Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share
Nextcloud is an open source content collaboration platform. From version 4.3.0 to before version 5.2.7, a removed collaborator retains unauthorized read access to uploaded respondent files for the affected form. The scope is limited to uploaded files for form…
-
Medium 5.7
MacGregor Voyage Data Recorder (VDR) G4e Files or Directories Accessible to External Parties
The administrator account for the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive files related to authentication, potentially changing the root password.
-
Medium 6.8
Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for de…