CWE-552
AllowedFiles or Directories Accessible to External Parties
Abstraction: Base · Status: Draft
The product makes files or directories accessible to unauthorized actors, even though they should not be.
714 vulnerabilities reference this CWE, most recent first.
GHSA-45J7-2QXV-QG3V
Vulnerability from github – Published: 2025-03-11 15:31 – Updated: 2025-03-11 15:31The ReadFile endpoint of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to read arbitrary files from the underlying OS.
{
"affected": [],
"aliases": [
"CVE-2025-22369"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-11T14:15:24Z",
"severity": "HIGH"
},
"details": "The ReadFile endpoint of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to read arbitrary files from the underlying OS.",
"id": "GHSA-45j7-2qxv-qg3v",
"modified": "2025-03-11T15:31:00Z",
"published": "2025-03-11T15:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22369"
},
{
"type": "WEB",
"url": "https://csirt.divd.nl/CVE-2025-22369"
},
{
"type": "WEB",
"url": "https://csirt.divd.nl/DIVD-2025-00003"
},
{
"type": "WEB",
"url": "https://www.mennekes.nl/fileadmin/MEN-Deutschland/emobility/04_software/06_smart_premium/Release_Notes_for_2.15_06.03.2025.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-4665-X724-M73J
Vulnerability from github – Published: 2022-02-08 00:00 – Updated: 2022-03-17 00:05The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server
{
"affected": [],
"aliases": [
"CVE-2021-24947"
],
"database_specific": {
"cwe_ids": [
"CWE-352",
"CWE-552",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-07T16:15:00Z",
"severity": "MODERATE"
},
"details": "The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server",
"id": "GHSA-4665-x724-m73j",
"modified": "2022-03-17T00:05:54Z",
"published": "2022-02-08T00:00:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24947"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/c6bb12b1-6961-40bd-9110-edfa9ee41a18"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-46GW-G4GV-V5GW
Vulnerability from github – Published: 2025-10-09 18:30 – Updated: 2025-10-09 18:30An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET method to access any file on the file system. Using specially crafted GET methods, an attacker can gain access to files beyond the file path normally allowed by the JBoss daemon. These files could contain sensitive information restricted from access by low-privileged users.This issue affects all versions of Junos Space before 24.1R3.
{
"affected": [],
"aliases": [
"CVE-2025-59976"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-09T16:15:47Z",
"severity": "HIGH"
},
"details": "An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET method to access any file on the file system. Using specially crafted GET methods, an attacker can gain access to files beyond the file path normally allowed by the JBoss daemon. These files could contain sensitive information restricted from access by low-privileged users.This issue affects all versions of Junos Space before 24.1R3.",
"id": "GHSA-46gw-g4gv-v5gw",
"modified": "2025-10-09T18:30:36Z",
"published": "2025-10-09T18:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59976"
},
{
"type": "WEB",
"url": "https://supportportal.juniper.net/JSA103170"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-46V5-GPCH-77VW
Vulnerability from github – Published: 2026-03-25 15:31 – Updated: 2026-03-26 12:30From Panorama Web HMI, an attacker can gain read access to certain Web HMI server files, if he knows their paths and if these files are accessible to the Servin process execution account.
- Installations based on Panorama Suite 2022-SP1 (22.50.005) are vulnerable unless update PS-2210-02-4079 (or higher) is installed
- Installations based on Panorama Suite 2023 (23.00.004) are vulnerable unless updates PS-2300-03-3078 (or higher) and PS-2300-04-3078 (or higher) and PS-2300-82-3078
(or higher)
are installed * Installations based on Panorama Suite 2025 (25.00.016)
are vulnerable unless updates PS-2500-02-1078 (or higher) and PS-2500-04-1078 (or higher) are installed * Installations based on Panorama Suite 2025 Updated Dec. 25 (25.10.007)
are vulnerable unless updates PS-2510-02-1077 (or higher) and PS-2510-04-1077 (or higher)
are installed
Please refer to security bulletin BS-035, available on the Panorama CSIRT website: https://my.codra.net/en-gb/csirt .
{
"affected": [],
"aliases": [
"CVE-2026-4760"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-25T13:16:27Z",
"severity": "HIGH"
},
"details": "From\nPanorama Web HMI, an attacker can gain read access to certain Web HMI server\nfiles, if he knows their paths and if these files are accessible to the Servin\nprocess execution account.\n\n * Installations based on Panorama Suite 2022-SP1 (22.50.005) are vulnerable unless update\u00a0PS-2210-02-4079\u00a0(or higher) is installed\n * Installations based on Panorama Suite 2023 (23.00.004) are vulnerable \nunless updates\u00a0PS-2300-03-3078\u00a0(or higher) and\u00a0PS-2300-04-3078\u00a0(or higher)\nand\u00a0PS-2300-82-3078\n\n(or higher)\n\nare installed\n * Installations based on Panorama Suite 2025\u00a0(25.00.016)\n\nare vulnerable unless updates\u00a0PS-2500-02-1078\u00a0(or higher) and\u00a0PS-2500-04-1078\u00a0(or higher) are installed\u00a0\n * Installations based on Panorama Suite 2025 Updated Dec. 25\u00a0(25.10.007)\n\nare vulnerable unless updates\u00a0PS-2510-02-1077\u00a0(or higher) and\u00a0PS-2510-04-1077\u00a0(or higher)\n\nare installed\n\n\n\n\nPlease refer to security bulletin BS-035, available on the Panorama CSIRT website:\u00a0 https://my.codra.net/en-gb/csirt .",
"id": "GHSA-46v5-gpch-77vw",
"modified": "2026-03-26T12:30:29Z",
"published": "2026-03-25T15:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4760"
},
{
"type": "WEB",
"url": "https://my.codra.net/api/csirt/download?resourceId=1467\u0026fileType=FichierPDF"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red",
"type": "CVSS_V4"
}
]
}
GHSA-4CQH-MQRW-7QQG
Vulnerability from github – Published: 2022-05-24 17:46 – Updated: 2022-05-24 17:46The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd
{
"affected": [],
"aliases": [
"CVE-2021-24154"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-05T19:15:00Z",
"severity": "MODERATE"
},
"details": "The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd",
"id": "GHSA-4cqh-mqrw-7qqg",
"modified": "2022-05-24T17:46:30Z",
"published": "2022-05-24T17:46:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24154"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/566c6836-fc3d-4dd9-b351-c3d9da9ec22e"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-4G73-W34J-P4W5
Vulnerability from github – Published: 2022-04-09 00:00 – Updated: 2022-04-15 00:00Movie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure vulnerability via /index.php?page=home.
{
"affected": [],
"aliases": [
"CVE-2022-28002"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-08T09:15:00Z",
"severity": "HIGH"
},
"details": "Movie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure vulnerability via /index.php?page=home.",
"id": "GHSA-4g73-w34j-p4w5",
"modified": "2022-04-15T00:00:57Z",
"published": "2022-04-09T00:00:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28002"
},
{
"type": "WEB",
"url": "https://github.com/D4rkP0w4r/CVEs/blob/main/Movie%20Seat%20Reservation%20System%20File%20Disclosure/POC.md"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/166658/Movie-Seat-Reservation-System-1.0-File-Disclosure-SQL-Injection.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4HMR-39VP-XFRR
Vulnerability from github – Published: 2025-02-24 21:31 – Updated: 2025-02-24 22:02Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed).
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.5.0-beta"
},
{
"fixed": "4.5.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.4.0-beta"
},
{
"fixed": "4.4.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.3.0-beta"
},
{
"fixed": "4.3.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.16"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-26525"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": true,
"github_reviewed_at": "2025-02-24T22:02:26Z",
"nvd_published_at": "2025-02-24T20:15:33Z",
"severity": "HIGH"
},
"details": "Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as \nthose with TeX Live installed).",
"id": "GHSA-4hmr-39vp-xfrr",
"modified": "2025-02-24T22:02:27Z",
"published": "2025-02-24T21:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26525"
},
{
"type": "WEB",
"url": "https://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-84136"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=466141"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Moodle has an arbitrary file read risk through pdfTeX"
}
GHSA-4M78-WR94-P294
Vulnerability from github – Published: 2023-07-05 15:30 – Updated: 2024-04-04 05:23A CWE-552 "Files or Directories Accessible to External Parties” in the web interface of the Tyan S5552 BMC version 3.00 allows an unauthenticated remote attacker to retrieve the private key of the TLS certificate in use by the BMC via forced browsing. This can then be abused to perform Man-in-the-Middle (MitM) attacks against victims that access the web interface through HTTPS.
{
"affected": [],
"aliases": [
"CVE-2023-2538"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-05T13:15:09Z",
"severity": "MODERATE"
},
"details": "A CWE-552 \"Files or Directories Accessible to External Parties\u201d in the web interface of the Tyan S5552 BMC version 3.00 allows an unauthenticated remote attacker to retrieve the private key of the TLS certificate in use by the BMC via forced browsing. This can then be abused to perform Man-in-the-Middle (MitM) attacks against victims that access the web interface through HTTPS.",
"id": "GHSA-4m78-wr94-p294",
"modified": "2024-04-04T05:23:28Z",
"published": "2023-07-05T15:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2538"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-2538"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-4MQ9-MP5G-R83Q
Vulnerability from github – Published: 2023-10-16 21:30 – Updated: 2024-04-04 08:41The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the gallery_edit function, allowing an attacker to access arbitrary resources on the server.
{
"affected": [],
"aliases": [
"CVE-2023-3155"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-16T20:15:14Z",
"severity": "HIGH"
},
"details": "The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server.",
"id": "GHSA-4mq9-mp5g-r83q",
"modified": "2024-04-04T08:41:15Z",
"published": "2023-10-16T21:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3155"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/5c8473f4-4b52-430b-9140-b81b0a0901da"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4PJM-2JF5-8H3G
Vulnerability from github – Published: 2025-03-23 15:30 – Updated: 2025-03-23 15:30A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /oews/admin/. The manipulation leads to exposure of information through directory listing. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. Multiple sub-directories are affected.
{
"affected": [],
"aliases": [
"CVE-2025-2651"
],
"database_specific": {
"cwe_ids": [
"CWE-548",
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-23T15:15:13Z",
"severity": "MODERATE"
},
"details": "A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /oews/admin/. The manipulation leads to exposure of information through directory listing. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. Multiple sub-directories are affected.",
"id": "GHSA-4pjm-2jf5-8h3g",
"modified": "2025-03-23T15:30:33Z",
"published": "2025-03-23T15:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2651"
},
{
"type": "WEB",
"url": "https://github.com/happytraveller-alone/cve/blob/main/Directory%20Traversal%20Vulnerability.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.300666"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.300666"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.519873"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
CAPEC-150: Collect Data from Common Resource Locations
An adversary exploits well-known locations for resources for the purposes of undermining the security of the target. In many, if not most systems, files and resources are organized in a default tree structure. This can be useful for adversaries because they often know where to look for resources or files that are necessary for attacks. Even when the precise location of a targeted resource may not be known, naming conventions may indicate a small area of the target machine's file tree where the resources are typically located. For example, configuration files are normally stored in the /etc director on Unix systems. Adversaries can take advantage of this to commit other types of attacks.
CAPEC-639: Probe System Files
An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.