CWEweakness
CWE-433 Unparsed Raw Web Content Delivery
- Abstraction
- Variant
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.
Extended description
If code is stored in a file with an extension such as ".inc" or ".pl", and the web server does not have a handler for that extension, then the server will likely send the contents of the file directly to the requester without the pre-processing that was expected. When that file contains sensitive information such as database credentials, this may allow the attacker to compromise the application or associated components.
Common consequences
• Confidentiality: Read Application Data
Potential mitigations
• [Architecture and Design] Perform a type check before interpreting files.
• [Architecture and Design] Do not store sensitive information in files which may be misinterpreted.
Observed examples
• CVE-2002-1886: ".inc" file stored under web document root and returned unparsed by the server
• CVE-2002-2065: ".inc" file stored under web document root and returned unparsed by the server
• CVE-2005-2029: ".inc" file stored under web document root and returned unparsed by the server
• CVE-2001-0330: direct request to .pl file leaves it unparsed
• CVE-2002-0614: .inc file
• CVE-2004-2353: unparsed config.conf file
• CVE-2007-3365: Chain: uppercase file extensions causes web server to return script source code instead of executing the script.
Related
Observed example · CVE (7)
- CVE-2007-3365 MyServer 0.8.9 and earlier does not properly handle uppercase characters in filename extensions, which allows remote attackers to obtain… vulnerability
- CVE-2005-2029 amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which… vulnerability
- CVE-2004-2353 BugPort before 1.099 stores its configuration file (conf/config.conf) under the web document root with a file extension that is not… vulnerability
- CVE-2002-1886 TightAuction 3.0 stores config.inc under the web document root with insufficient access control, which allows remote attackers to obtain… vulnerability
- CVE-2002-2065 WebCalendar 0.9.34 and earlier with 'browsing in includes directory' enabled allows remote attackers to read arbitrary include files with… vulnerability
- CVE-2002-0614 PHP-Survey 20000615 and earlier stores the global.inc file under the web root, which allows remote attackers to obtain sensitive… vulnerability
- CVE-2001-0330 Bugzilla 2.10 allows remote attackers to access sensitive information, including the database username and password, via an HTTP request… vulnerability
Child of · CWE (1)
- CWE-219 Storage of File with Sensitive Data Under Web Root weakness
Referenced by CVE · weakness (1)
- CVE-2026-31841 Hyperterse is a tool-first MCP framework for building AI-ready backend surfaces from declarative config. vulnerability