CWE-552
AllowedFiles or Directories Accessible to External Parties
Abstraction: Base · Status: Draft
The product makes files or directories accessible to unauthorized actors, even though they should not be.
714 vulnerabilities reference this CWE, most recent first.
GHSA-G98M-96G9-WFJQ
Vulnerability from github – Published: 2021-05-10 14:53 – Updated: 2023-07-05 20:18Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "bundler"
},
"ranges": [
{
"events": [
{
"introduced": "1.14.0"
},
{
"fixed": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-3881"
],
"database_specific": {
"cwe_ids": [
"CWE-427",
"CWE-552"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-04T22:52:44Z",
"nvd_published_at": "2020-09-04T12:15:00Z",
"severity": "HIGH"
},
"details": "Bundler prior to 2.1.0 uses a predictable path in `/tmp/`, created with insecure permissions as a storage location for gems, if locations under the user\u0027s home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.",
"id": "GHSA-g98m-96g9-wfjq",
"modified": "2023-07-05T20:18:22Z",
"published": "2021-05-10T14:53:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3881"
},
{
"type": "WEB",
"url": "https://github.com/rubygems/bundler/issues/6501"
},
{
"type": "WEB",
"url": "https://github.com/rubygems/bundler/pull/7416/commits/65cfebb041c454c246aaf32a177b0243915a9998"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1651826"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-g98m-96g9-wfjq"
},
{
"type": "PACKAGE",
"url": "https://github.com/rubygems/bundler"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bundler/CVE-2019-3881.yml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Insecure path handling in Bundler"
}
GHSA-GC72-8HPQ-4VJW
Vulnerability from github – Published: 2022-05-26 00:01 – Updated: 2022-06-10 00:00Docker Desktop 4.3.0 has Incorrect Access Control.
{
"affected": [],
"aliases": [
"CVE-2021-44719"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-25T16:15:00Z",
"severity": "HIGH"
},
"details": "Docker Desktop 4.3.0 has Incorrect Access Control.",
"id": "GHSA-gc72-8hpq-4vjw",
"modified": "2022-06-10T00:00:49Z",
"published": "2022-05-26T00:01:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44719"
},
{
"type": "WEB",
"url": "https://docs.docker.com/desktop/mac/release-notes"
},
{
"type": "WEB",
"url": "https://docs.docker.com/desktop/release-notes/#security-2"
},
{
"type": "WEB",
"url": "https://docs.docker.com/desktop/windows/release-notes"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GC9P-9Q92-4WC8
Vulnerability from github – Published: 2025-11-19 03:31 – Updated: 2025-11-19 03:31Tanium addressed an arbitrary file deletion vulnerability in TanOS.
{
"affected": [],
"aliases": [
"CVE-2025-13225"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-19T03:16:03Z",
"severity": "MODERATE"
},
"details": "Tanium addressed an arbitrary file deletion vulnerability in TanOS.",
"id": "GHSA-gc9p-9q92-4wc8",
"modified": "2025-11-19T03:31:06Z",
"published": "2025-11-19T03:31:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13225"
},
{
"type": "WEB",
"url": "https://security.tanium.com/TAN-2025-036"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-GF6V-V2M7-4PR4
Vulnerability from github – Published: 2025-02-14 00:30 – Updated: 2025-02-14 00:30An attacker could obtain firmware files and reverse engineer their intended use leading to loss of confidentiality and integrity of the hardware devices enabled by the Qardio iOS and Android applications.
{
"affected": [],
"aliases": [
"CVE-2025-23421"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-13T22:15:12Z",
"severity": "MODERATE"
},
"details": "An attacker could obtain firmware files and reverse engineer their \nintended use leading to loss of confidentiality and integrity of the \nhardware devices enabled by the Qardio iOS and Android applications.",
"id": "GHSA-gf6v-v2m7-4pr4",
"modified": "2025-02-14T00:30:44Z",
"published": "2025-02-14T00:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23421"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-044-01"
},
{
"type": "WEB",
"url": "https://www.qardio.com/about-us/#contact"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GG9W-4VV2-VJCM
Vulnerability from github – Published: 2026-09-03 15:32 – Updated: 2026-09-03 15:32SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan's CA (ca.key).
{
"affected": [],
"aliases": [
"CVE-2026-85175"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-03T13:06:25Z",
"severity": "HIGH"
},
"details": "SiYuan versions \u003c= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan\u0027s CA (ca.key).",
"id": "GHSA-gg9w-4vv2-vjcm",
"modified": "2026-09-03T15:32:21Z",
"published": "2026-09-03T15:32:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4wwp-f6gw-6qm5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85175"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/siyuan-before-3.8.2-tls-private-key-disclosure-via-getfile"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GGP3-C9PX-5C4P
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-08-11 00:00If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected data. This could have resulted in Thunderbird showing incorrect information, for example the attacker could have tricked Thunderbird to show folders that didn't exist on the IMAP server. This vulnerability affects Thunderbird < 78.12.
{
"affected": [],
"aliases": [
"CVE-2021-29969"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-05T20:15:00Z",
"severity": "MODERATE"
},
"details": "If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn\u0027t ignore the injected data. This could have resulted in Thunderbird showing incorrect information, for example the attacker could have tricked Thunderbird to show folders that didn\u0027t exist on the IMAP server. This vulnerability affects Thunderbird \u003c 78.12.",
"id": "GHSA-ggp3-c9px-5c4p",
"modified": "2022-08-11T00:00:29Z",
"published": "2022-05-24T19:10:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29969"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1682370"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202208-14"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2021-30"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GGQW-H359-HVRR
Vulnerability from github – Published: 2025-08-21 15:30 – Updated: 2025-08-21 18:31MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an attacker to execute arbitrary commands
{
"affected": [],
"aliases": [
"CVE-2025-51818"
],
"database_specific": {
"cwe_ids": [
"CWE-552",
"CWE-77"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-21T14:15:40Z",
"severity": "MODERATE"
},
"details": "MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an attacker to execute arbitrary commands",
"id": "GHSA-ggqw-h359-hvrr",
"modified": "2025-08-21T18:31:26Z",
"published": "2025-08-21T15:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51818"
},
{
"type": "WEB",
"url": "https://github.com/Y4y17/CVE/blob/main/Arbitrary%20file%20deletion%20vulnerability.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GH53-MCRP-WP5M
Vulnerability from github – Published: 2022-05-24 17:31 – Updated: 2022-05-24 17:31Dell EMC NetWorker versions prior to 19.3.0.2 contain an improper authorization vulnerability. Certain remote users with low privileges may exploit this vulnerability to perform 'nsrmmdbd' operations in an unintended manner.
{
"affected": [],
"aliases": [
"CVE-2020-26183"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-16T18:15:00Z",
"severity": "MODERATE"
},
"details": "Dell EMC NetWorker versions prior to 19.3.0.2 contain an improper authorization vulnerability. Certain remote users with low privileges may exploit this vulnerability to perform \u0027nsrmmdbd\u0027 operations in an unintended manner.",
"id": "GHSA-gh53-mcrp-wp5m",
"modified": "2022-05-24T17:31:03Z",
"published": "2022-05-24T17:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26183"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/security/en-us/details/546616/DSA-2020-229-Dell-EMC-NetWorker-Multiple-Security-Vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GPCV-CXPV-WV29
Vulnerability from github – Published: 2022-03-29 00:01 – Updated: 2022-04-01 00:0074cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php.
{
"affected": [],
"aliases": [
"CVE-2022-26271"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-28T01:15:00Z",
"severity": "HIGH"
},
"details": "74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \\index\\controller\\Download.php.",
"id": "GHSA-gpcv-cxpv-wv29",
"modified": "2022-04-01T00:00:48Z",
"published": "2022-03-29T00:01:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26271"
},
{
"type": "WEB",
"url": "https://github.com/N1ce759/74cmsSE-Arbitrary-File-Reading/issues/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GQF3-X727-H474
Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2022-05-24 17:32Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp application even after the phone was locked.
{
"affected": [],
"aliases": [
"CVE-2020-1908"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-03T20:15:00Z",
"severity": "MODERATE"
},
"details": "Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp application even after the phone was locked.",
"id": "GHSA-gqf3-x727-h474",
"modified": "2022-05-24T17:32:58Z",
"published": "2022-05-24T17:32:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1908"
},
{
"type": "WEB",
"url": "https://www.whatsapp.com/security/advisories/2020"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
CAPEC-150: Collect Data from Common Resource Locations
An adversary exploits well-known locations for resources for the purposes of undermining the security of the target. In many, if not most systems, files and resources are organized in a default tree structure. This can be useful for adversaries because they often know where to look for resources or files that are necessary for attacks. Even when the precise location of a targeted resource may not be known, naming conventions may indicate a small area of the target machine's file tree where the resources are typically located. For example, configuration files are normally stored in the /etc director on Unix systems. Adversaries can take advantage of this to commit other types of attacks.
CAPEC-639: Probe System Files
An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.