CWE-552
AllowedFiles or Directories Accessible to External Parties
Abstraction: Base · Status: Draft
The product makes files or directories accessible to unauthorized actors, even though they should not be.
714 vulnerabilities reference this CWE, most recent first.
GHSA-69H4-9VCF-3H5Q
Vulnerability from github – Published: 2022-05-24 17:07 – Updated: 2022-05-26 00:01An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter.
{
"affected": [],
"aliases": [
"CVE-2020-3927"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-03T11:15:00Z",
"severity": "HIGH"
},
"details": "An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter.",
"id": "GHSA-69h4-9vcf-3h5q",
"modified": "2022-05-26T00:01:12Z",
"published": "2022-05-24T17:07:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3927"
},
{
"type": "WEB",
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201910007"
},
{
"type": "WEB",
"url": "https://www.chtsecurity.com/news/1179d48b-7609-4f67-9d7e-3bac2979c6ce"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6C75-M6FQ-9MH7
Vulnerability from github – Published: 2023-01-03 00:30 – Updated: 2023-01-09 18:30The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server
{
"affected": [],
"aliases": [
"CVE-2022-4140"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-02T22:15:00Z",
"severity": "HIGH"
},
"details": "The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server",
"id": "GHSA-6c75-m6fq-9mh7",
"modified": "2023-01-09T18:30:17Z",
"published": "2023-01-03T00:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4140"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/0d649a7e-3334-48f7-abca-fff0856e12c7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6HFV-JW53-QRC2
Vulnerability from github – Published: 2023-02-27 18:32 – Updated: 2023-03-04 06:30The Correos Oficial WordPress plugin through 1.2.0.2 does not have an authorization check user input validation when generating a file path, allowing unauthenticated attackers to download arbitrary files from the server.
{
"affected": [],
"aliases": [
"CVE-2023-0331"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-27T16:15:00Z",
"severity": "HIGH"
},
"details": "The Correos Oficial WordPress plugin through 1.2.0.2 does not have an authorization check user input validation when generating a file path, allowing unauthenticated attackers to download arbitrary files from the server.",
"id": "GHSA-6hfv-jw53-qrc2",
"modified": "2023-03-04T06:30:22Z",
"published": "2023-02-27T18:32:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0331"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/1b4dbaf3-1364-4103-9a7b-b5a1355c685b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6HW8-GQ2C-479X
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-05-24 19:10Dell DBUtilDrv2.sys driver (versions 2.5 and 2.6) contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.
{
"affected": [],
"aliases": [
"CVE-2021-36276"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-09T21:15:00Z",
"severity": "HIGH"
},
"details": "Dell DBUtilDrv2.sys driver (versions 2.5 and 2.6) contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.",
"id": "GHSA-6hw8-gq2c-479x",
"modified": "2022-05-24T19:10:24Z",
"published": "2022-05-24T19:10:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36276"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000190105/dsa-2021-152-dell-client-platform-security-update-for-an-insufficient-access-control-vulnerability-in-the-dell-dbutildrv2-sys-driver"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6J5R-8VHM-P3X4
Vulnerability from github – Published: 2022-10-17 19:00 – Updated: 2022-10-21 19:01The Helpful WordPress plugin before 4.5.26 puts the exported logs and feedbacks in a publicly accessible location and guessable names, which could allow attackers to download them and retrieve sensitive information such as IP, Names and Email Address depending on the plugin's settings
{
"affected": [],
"aliases": [
"CVE-2022-2834"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-17T12:15:00Z",
"severity": "MODERATE"
},
"details": "The Helpful WordPress plugin before 4.5.26 puts the exported logs and feedbacks in a publicly accessible location and guessable names, which could allow attackers to download them and retrieve sensitive information such as IP, Names and Email Address depending on the plugin\u0027s settings",
"id": "GHSA-6j5r-8vhm-p3x4",
"modified": "2022-10-21T19:01:14Z",
"published": "2022-10-17T19:00:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2834"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/468d5fc7-04c6-4354-b134-85ebb25b37ae"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6P3H-R2C5-CH3V
Vulnerability from github – Published: 2022-05-24 17:30 – Updated: 2022-06-04 00:00The local file inclusion vulnerability present in B&R SiteManager versions <9.2.620236042 allows authenticated users to impact availability of SiteManager instances.
{
"affected": [],
"aliases": [
"CVE-2020-11642"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-15T15:15:00Z",
"severity": "MODERATE"
},
"details": "The local file inclusion vulnerability present in B\u0026R SiteManager versions \u003c9.2.620236042 allows authenticated users to impact availability of SiteManager instances.",
"id": "GHSA-6p3h-r2c5-ch3v",
"modified": "2022-06-04T00:00:33Z",
"published": "2022-05-24T17:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11642"
},
{
"type": "WEB",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-273-03"
},
{
"type": "WEB",
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1600003183751-de-original-1.0.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6P6H-9JG2-W75J
Vulnerability from github – Published: 2025-07-17 18:31 – Updated: 2025-07-24 21:30OA EKP v16 was discovered to contain an arbitrary download vulnerability via the component /ui/sys_ui_extend/sysUiExtend.do. This vulnerability allows attackers to obtain the password of the background administrator and further obtain database permissions.
{
"affected": [],
"aliases": [
"CVE-2023-41566"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-17T16:15:34Z",
"severity": "HIGH"
},
"details": "OA EKP v16 was discovered to contain an arbitrary download vulnerability via the component /ui/sys_ui_extend/sysUiExtend.do. This vulnerability allows attackers to obtain the password of the background administrator and further obtain database permissions.",
"id": "GHSA-6p6h-9jg2-w75j",
"modified": "2025-07-24T21:30:37Z",
"published": "2025-07-17T18:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41566"
},
{
"type": "WEB",
"url": "https://gist.github.com/night-0p/668fc88385d4f60feb90b7fcef8443b1"
},
{
"type": "WEB",
"url": "https://github.com/night-0p/anh/blob/main/Landray%20OA/FileDownload.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6Q4V-9F44-VXXX
Vulnerability from github – Published: 2024-11-27 03:31 – Updated: 2025-03-05 15:30A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.
{
"affected": [],
"aliases": [
"CVE-2024-53676"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-27T01:15:05Z",
"severity": "CRITICAL"
},
"details": "A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.",
"id": "GHSA-6q4v-9f44-vxxx",
"modified": "2025-03-05T15:30:50Z",
"published": "2024-11-27T03:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53676"
},
{
"type": "WEB",
"url": "https://github.com/pwnfuzz/POCs/tree/main/CVE-2024-53676"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbgn04731en_us"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6R67-R3JM-88P4
Vulnerability from github – Published: 2022-05-13 01:11 – Updated: 2025-10-22 00:31Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
{
"affected": [],
"aliases": [
"CVE-2017-16651"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-09T14:29:00Z",
"severity": "HIGH"
},
"details": "Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host\u0027s filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings\u0026_action=upload-display\u0026_from=timezone requests.",
"id": "GHSA-6r67-r3jm-88p4",
"modified": "2025-10-22T00:31:29Z",
"published": "2022-05-13T01:11:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16651"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/issues/6026"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.1.10"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.2.7"
},
{
"type": "WEB",
"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.3.3"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html"
},
{
"type": "WEB",
"url": "https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-16651"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2017/dsa-4030"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101793"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6VGR-R2FG-P38Q
Vulnerability from github – Published: 2026-08-27 21:31 – Updated: 2026-08-28 21:31Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled scrape endpoint. This may disclose files accessible to the Alloy process, including its projected Kubernetes service account token, potentially granting the attacker Alloy’s Kubernetes permissions. Exploitation requires ServiceMonitor write access and lower privileges than Alloy’s service account.
{
"affected": [],
"aliases": [
"CVE-2026-75889"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-27T20:18:37Z",
"severity": "HIGH"
},
"details": "Grafana Alloy\u2019s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled scrape endpoint. This may disclose files accessible to the Alloy process, including its projected Kubernetes service account token, potentially granting the attacker Alloy\u2019s Kubernetes permissions. Exploitation requires ServiceMonitor write access and lower privileges than Alloy\u2019s service account.",
"id": "GHSA-6vgr-r2fg-p38q",
"modified": "2026-08-28T21:31:07Z",
"published": "2026-08-27T21:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75889"
},
{
"type": "WEB",
"url": "https://grafana.com/security/security-advisories/cve-2026-75889"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
CAPEC-150: Collect Data from Common Resource Locations
An adversary exploits well-known locations for resources for the purposes of undermining the security of the target. In many, if not most systems, files and resources are organized in a default tree structure. This can be useful for adversaries because they often know where to look for resources or files that are necessary for attacks. Even when the precise location of a targeted resource may not be known, naming conventions may indicate a small area of the target machine's file tree where the resources are typically located. For example, configuration files are normally stored in the /etc director on Unix systems. Adversaries can take advantage of this to commit other types of attacks.
CAPEC-639: Probe System Files
An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.