CWEweakness
CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
- Abstraction
- Base
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
Common consequences
• Confidentiality: Read Files or Directories
Potential mitigations
• [Architecture and Design, Operation, System Configuration] Do not expose file and directory information to the user.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2018-1999036: SSH password for private key stored in build log
Related
Attack pattern · CAPEC (1)
- CAPEC-95 WSDL Scanning attack pattern
Observed example · CVE (1)
- CVE-2018-1999036 An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that… vulnerability
Child of · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
Referenced by CAPEC · weakness (1)
- CAPEC-95 WSDL Scanning attack pattern
Referenced by CVE · weakness (108)
- CVE-2026-115707 Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to… vulnerability
- CVE-2026-115711 Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to… vulnerability
- CVE-2026-114195 Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic… vulnerability
- CVE-2026-112027 A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. vulnerability
- CVE-2026-109970 A flaw was found in the clevis PKCS#11 pin. vulnerability
- CVE-2026-96944 Insertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized attacker to… vulnerability
- CVE-2026-108937 A vulnerability was detected in code-projects Online Ticket Reservation System 1.0. vulnerability
- CVE-2026-44828 Qexo is an open source online editor for static blogs. vulnerability
- CVE-2026-25827 An issue was discovered in Keyfactor SignServer before 7.6.0. vulnerability
- CVE-2026-57442 MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. vulnerability
- CVE-2026-80175 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of… vulnerability
- CVE-2026-69507 Insertion of sensitive information into externally-accessible file or directory in Microsoft Windows Search Component allows an authorized… vulnerability
- CVE-2026-67361 Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20,… vulnerability
- CVE-2026-19229 A vulnerability was determined in SourceCodester Online Clothing Store. vulnerability
- CVE-2026-12762 IBM Cloud Pak For Business Automation 24.0.0, 24.0.1, 25.0.0, and 26.0.0 could allow a remote attacker to obtain sensitive information… vulnerability
- CVE-2026-15574 A flaw was found in the vllm-orchestrator-gateway component. vulnerability
- CVE-2025-36372 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive… vulnerability
- CVE-2026-50099 During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed… vulnerability
- CVE-2026-29114 A vulnerability has been found in some Dahua products. vulnerability
- CVE-2026-46617 Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on… vulnerability
- CVE-2026-50565 Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on… vulnerability
- CVE-2019-25717 Dräger Infinity Delta, Delta XL, and Kappa patient monitors contain an information disclosure vulnerability that allows unauthenticated… vulnerability
- CVE-2026-10254 A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. vulnerability
- CVE-2026-49298 A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed… vulnerability
- CVE-2026-5434 Honeywell Control Network Module (CNM) contains insertion of sensitive information into an unintended directory. vulnerability
- CVE-2026-27173 JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. vulnerability
- CVE-2023-54346 WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download… vulnerability
- CVE-2026-7071 A security vulnerability has been detected in CodeAstro Online Job Portal 1.0. vulnerability
- CVE-2026-6160 A vulnerability was found in code-projects Simple ChatBox 1.0. vulnerability
- CVE-2019-25706 Across DR-810 contains an unauthenticated file disclosure vulnerability that allows remote attackers to download the rom-0 backup file… vulnerability