CWE-552
AllowedFiles or Directories Accessible to External Parties
Abstraction: Base · Status: Draft
The product makes files or directories accessible to unauthorized actors, even though they should not be.
712 vulnerabilities reference this CWE, most recent first.
GHSA-P9XF-3RM3-QH2H
Vulnerability from github – Published: 2022-05-25 00:00 – Updated: 2022-08-11 13:22A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability. This flaw affects wildfly-core versions prior to 17.0.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.wildfly.core:wildfly-core-parent"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "17.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-3717"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-16T23:22:01Z",
"nvd_published_at": "2022-05-24T19:15:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability. This flaw affects wildfly-core versions prior to 17.0.",
"id": "GHSA-p9xf-3rm3-qh2h",
"modified": "2022-08-11T13:22:17Z",
"published": "2022-05-25T00:00:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3717"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1991305"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220804-0002"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Wildfly-Core user account mismanagement"
}
GHSA-PG6M-MHV8-FPMP
Vulnerability from github – Published: 2026-06-19 00:31 – Updated: 2026-06-19 00:31Improper input validation in AVer PTC500S, PTC115, PTC500+, and PTC115+ cameras may allow a remote, unauthenticated attacker to achieve arbitrary code execution via a specially crafted web request.
{
"affected": [],
"aliases": [
"CVE-2026-40624"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-19T00:16:47Z",
"severity": "CRITICAL"
},
"details": "Improper input validation in AVer PTC500S, PTC115, PTC500+, and PTC115+ \ncameras may allow a remote, unauthenticated attacker to achieve \narbitrary code execution via a specially crafted web request.",
"id": "GHSA-pg6m-mhv8-fpmp",
"modified": "2026-06-19T00:31:38Z",
"published": "2026-06-19T00:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40624"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-169-01.json"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PGF9-H69P-PCGF
Vulnerability from github – Published: 2018-10-17 20:29 – Updated: 2024-03-05 18:07Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-core"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-core"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-5211"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-552"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:49:06Z",
"nvd_published_at": "2017-05-25T17:29:00Z",
"severity": "HIGH"
},
"details": "Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.",
"id": "GHSA-pgf9-h69p-pcgf",
"modified": "2024-03-05T18:07:02Z",
"published": "2018-10-17T20:29:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5211"
},
{
"type": "WEB",
"url": "https://github.com/spring-projects/spring-framework/commit/03f547eb9868f48f44d59b56067d4ac4740672c3"
},
{
"type": "WEB",
"url": "https://github.com/spring-projects/spring-framework/commit/2bd1daa75ee0b8ec33608ca6ab065ef3e1815543"
},
{
"type": "WEB",
"url": "https://github.com/spring-projects/spring-framework/commit/a95c3d820dbc4c3ae752f1b3ee22ee860b162402"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-pgf9-h69p-pcgf"
},
{
"type": "PACKAGE",
"url": "https://github.com/spring-projects/spring-framework"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html"
},
{
"type": "WEB",
"url": "https://pivotal.io/security/cve-2015-5211"
},
{
"type": "WEB",
"url": "https://www.trustwave.com/Resources/SpiderLabs-Blog/Reflected-File-Download---A-New-Web-Attack-Vector"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Files or Directories Accessible to External Parties in org.springframework:spring-core"
}
GHSA-PGMF-2FGQ-P4JP
Vulnerability from github – Published: 2026-09-04 09:31 – Updated: 2026-09-04 15:36The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.
{
"affected": [],
"aliases": [
"CVE-2026-74853"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-04T07:17:09Z",
"severity": "MODERATE"
},
"details": "The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.",
"id": "GHSA-pgmf-2fgq-p4jp",
"modified": "2026-09-04T15:36:06Z",
"published": "2026-09-04T09:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74853"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/f53b628f-c825-4cf5-91bd-13bd9526e90c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PHHQ-63JG-FP7R
Vulnerability from github – Published: 2025-07-09 17:56 – Updated: 2025-07-09 17:56Background
The VOLUME directive in Dockerfiles, or the config.volumes field in OCI image descriptors, indicates filesystem paths "where the process is likely to write data". While these paths have special semantics in Docker, they are only hints in the OCI spec and are not treated specially by Kubernetes. However, containered implements the specified conversion logic and adds a mount point if there is none set by Kubernetes.
Unfortunately, the specification leaves it open whether the mount point is populated with any and what data, so the runtime needs to be able to push arbitrary data to the Kata agent. However, this is almost always not what the user wants:
- A declared
VOLUMElocation is usually important to the app's core functionality, which is usually at odds with the data in that location being untrusted. VOLUMEdeclarations are often used by image vendors to indicate "mount your persistence here" to the user. They are rarely useful without a real volume mounted there.
Impact
All of the following need to be true to be affected by this vulnerability:
- A bare metal Contrast deployment (AKS is not affected).
- An image with at least one VOLUME directive.
- No Kubernetes mount at the path of the VOLUME.
If these are all true, the host is able to write arbitrary trees below that mount point.
Patches
Patched in v1.9.1 by disallowing this configuration in contrast generate.
Workarounds
Explicitly mount an emptyDir to all VOLUME locations. If the initial data in these locations is needed by the application, the image needs to be modified to remove the config.volumes entries.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/edgelesssys/contrast"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-552",
"CWE-693"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-09T17:56:24Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Background\n\nThe [`VOLUME`](https://docs.docker.com/reference/dockerfile/#volume) directive in Dockerfiles, or the [`config.volumes`](https://github.com/opencontainers/image-spec/blob/06e6b47e2ef69021d9f9bf2cfa5fe43a7e010c81/config.md?plain=1#L168-L170) field in OCI image descriptors, indicates filesystem paths \"where the process is likely to write data\". While these paths have special semantics in Docker, they are only hints in the OCI spec and are not treated specially by Kubernetes. However, containered implements the [specified conversion logic](https://github.com/opencontainers/image-spec/blob/06e6b47e2ef69021d9f9bf2cfa5fe43a7e010c81/conversion.md?plain=1#L100-L105) and adds a mount point if there is none set by Kubernetes.\n\nUnfortunately, the specification leaves it open whether the mount point is populated with any and what data, so the runtime needs to be able to push arbitrary data to the Kata agent. However, this is almost always not what the user wants:\n\n1. A declared `VOLUME` location is usually important to the app\u0027s core functionality, which is usually at odds with the data in that location being untrusted.\n2. `VOLUME` declarations are often used by image vendors to indicate \"mount your persistence here\" to the user. They are rarely useful without a real volume mounted there.\n\n### Impact\n\nAll of the following need to be true to be affected by this vulnerability:\n\n1. A bare metal Contrast deployment (AKS is not affected).\n2. An image with at least one VOLUME directive.\n3. No Kubernetes mount at the path of the VOLUME.\n\nIf these are all true, the host is able to write arbitrary trees below that mount point.\n\n### Patches\n\nPatched in v1.9.1 by disallowing this configuration in `contrast generate`.\n\n### Workarounds\n\nExplicitly mount an `emptyDir` to all `VOLUME` locations. If the initial data in these locations is needed by the application, the image needs to be modified to remove the `config.volumes` entries.",
"id": "GHSA-phhq-63jg-fp7r",
"modified": "2025-07-09T17:56:24Z",
"published": "2025-07-09T17:56:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/edgelesssys/contrast/security/advisories/GHSA-phhq-63jg-fp7r"
},
{
"type": "WEB",
"url": "https://github.com/edgelesssys/contrast/commit/635b471ddbb512b6661e6f1d767aab818bd50bda"
},
{
"type": "PACKAGE",
"url": "https://github.com/edgelesssys/contrast"
},
{
"type": "WEB",
"url": "https://github.com/edgelesssys/contrast/releases/tag/v1.9.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Contrast vulnerability allows arbitrary host data Injection into container VOLUME mount points"
}
GHSA-PHJP-6Q2X-Q4WX
Vulnerability from github – Published: 2022-05-24 17:31 – Updated: 2022-05-24 17:31Dell EMC NetWorker versions prior to 19.3.0.2 contain an incorrect privilege assignment vulnerability. A non-LDAP remote user with low privileges may exploit this vulnerability to perform 'saveset' related operations in an unintended manner. The vulnerability is not exploitable by users authenticated via LDAP.
{
"affected": [],
"aliases": [
"CVE-2020-26182"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-16T18:15:00Z",
"severity": "MODERATE"
},
"details": "Dell EMC NetWorker versions prior to 19.3.0.2 contain an incorrect privilege assignment vulnerability. A non-LDAP remote user with low privileges may exploit this vulnerability to perform \u0027saveset\u0027 related operations in an unintended manner. The vulnerability is not exploitable by users authenticated via LDAP.",
"id": "GHSA-phjp-6q2x-q4wx",
"modified": "2022-05-24T17:31:03Z",
"published": "2022-05-24T17:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26182"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/security/en-us/details/546616/DSA-2020-229-Dell-EMC-NetWorker-Multiple-Security-Vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-PMGM-PV8C-PW29
Vulnerability from github – Published: 2021-12-17 00:00 – Updated: 2023-11-14 21:30In Bus Pass Management System v1.0, Directory Listing/Browsing is enabled on the web server which allows an attacker to view the sensitive files of the application, for example: Any file which contains sensitive information of the user or server.
{
"affected": [],
"aliases": [
"CVE-2021-44315"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-16T19:15:00Z",
"severity": "HIGH"
},
"details": "In Bus Pass Management System v1.0, Directory Listing/Browsing is enabled on the web server which allows an attacker to view the sensitive files of the application, for example: Any file which contains sensitive information of the user or server.",
"id": "GHSA-pmgm-pv8c-pw29",
"modified": "2023-11-14T21:30:47Z",
"published": "2021-12-17T00:00:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44315"
},
{
"type": "WEB",
"url": "https://github.com/abhiunix/Bus-Pass-Management-System-v1.0/blob/master/Directory%20listing/Report_Directory%20listing.pdf"
},
{
"type": "WEB",
"url": "https://github.com/abhiunix/Bus-Pass-Management-System-v1.0/tree/master/Directory%20listing"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PMX6-P7G8-55GF
Vulnerability from github – Published: 2021-12-04 00:00 – Updated: 2021-12-07 00:00Trend Micro Security 2021 v17.0 (Consumer) contains a vulnerability that allows files inside the protected folder to be modified without any detection.
{
"affected": [],
"aliases": [
"CVE-2021-43772"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-03T11:15:00Z",
"severity": "MODERATE"
},
"details": "Trend Micro Security 2021 v17.0 (Consumer) contains a vulnerability that allows files inside the protected folder to be modified without any detection.",
"id": "GHSA-pmx6-p7g8-55gf",
"modified": "2021-12-07T00:00:59Z",
"published": "2021-12-04T00:00:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43772"
},
{
"type": "WEB",
"url": "https://helpcenter.trendmicro.com/en-us/article/tmka-10855"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-PRC6-9XC4-P6V8
Vulnerability from github – Published: 2025-03-11 12:30 – Updated: 2025-03-11 12:30A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected application does not properly restrict the scope of files accessible to the simulation model. This could allow an unauthorized attacker to compromise the confidentiality of the system.
{
"affected": [],
"aliases": [
"CVE-2025-25267"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-11T10:15:18Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions \u003c V2302.0021), Tecnomatix Plant Simulation V2404 (All versions \u003c V2404.0010). The affected application does not properly restrict the scope of files accessible to the simulation model. This could allow an unauthorized attacker to compromise the confidentiality of the system.",
"id": "GHSA-prc6-9xc4-p6v8",
"modified": "2025-03-11T12:30:59Z",
"published": "2025-03-11T12:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25267"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-507653.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PWFP-GQPX-2MGG
Vulnerability from github – Published: 2023-10-30 15:30 – Updated: 2023-11-13 15:30The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to include local file and potentially execute code on the server. While subscribers may need to poison log files or otherwise get a file installed in order to achieve remote code execution, author and above users can upload files by default and achieve remote code execution easily.
{
"affected": [],
"aliases": [
"CVE-2023-5199"
],
"database_specific": {
"cwe_ids": [
"CWE-552",
"CWE-98"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-30T14:15:09Z",
"severity": "HIGH"
},
"details": "The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the \u0027php-to-page\u0027 shortcode. This allows authenticated attackers with subscriber-level permissions or above, to include local file and potentially execute code on the server. While subscribers may need to poison log files or otherwise get a file installed in order to achieve remote code execution, author and above users can upload files by default and achieve remote code execution easily.",
"id": "GHSA-pwfp-gqpx-2mgg",
"modified": "2023-11-13T15:30:19Z",
"published": "2023-10-30T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5199"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/php-to-page/trunk/php-to-page.php?rev=441028#L22"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/83e5a0dc-fc51-4565-945f-190cf9175874?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
CAPEC-150: Collect Data from Common Resource Locations
An adversary exploits well-known locations for resources for the purposes of undermining the security of the target. In many, if not most systems, files and resources are organized in a default tree structure. This can be useful for adversaries because they often know where to look for resources or files that are necessary for attacks. Even when the precise location of a targeted resource may not be known, naming conventions may indicate a small area of the target machine's file tree where the resources are typically located. For example, configuration files are normally stored in the /etc director on Unix systems. Adversaries can take advantage of this to commit other types of attacks.
CAPEC-639: Probe System Files
An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.