CWEweakness
CWE-552 Files or Directories Accessible to External Parties
- Abstraction
- Base
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product makes files or directories accessible to unauthorized actors, even though they should not be.
Extended description
Web servers, FTP servers, and similar servers may store a set of files underneath a "root" directory that is accessible to the server's users. Applications may store sensitive files underneath this root without also using access control to limit which users may request those files, if any. Alternately, an application might package multiple files or directories into an archive file (e.g., ZIP or tar), but the application might not exclude sensitive files that are underneath those directories.
Common consequences
• Confidentiality, Integrity: Read Files or Directories, Modify Files or Directories
Potential mitigations
• [Implementation, System Configuration, Operation] When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2005-1835: Data file under web root.
Related
Attack pattern · CAPEC (2)
Observed example · CVE (1)
- CVE-2005-1835 NEXTWEB (i)Site stores databases under the web document root with insufficient access control, which allows remote attackers to obtain… vulnerability
Child of · CWE (2)
Referenced by CAPEC · weakness (2)
Referenced by CVE · weakness (538)
- CVE-2026-67073 HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. vulnerability
- CVE-2026-65210 This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond… vulnerability
- CVE-2026-46651 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. vulnerability
- CVE-2026-114400 Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket… vulnerability
- CVE-2026-76531 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security… vulnerability
- CVE-2026-112948 Vitest is a testing framework powered by Vite. vulnerability
- CVE-2026-87348 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt). vulnerability
- CVE-2026-112144 A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. vulnerability
- CVE-2026-102695 OmniFaces is a utility library for Faces. vulnerability
- CVE-2026-108070 A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to… vulnerability
- CVE-2026-109162 Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder… vulnerability
- CVE-2026-85812 Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information… vulnerability
- CVE-2026-85840 Files or directories accessible to external parties in Windows Event Viewer allows an authorized attacker to disclose information over a… vulnerability
- CVE-2026-88137 Files or directories accessible to external parties in WebDAV allows an authorized attacker to disclose information over a network. vulnerability
- CVE-2026-89118 SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application… vulnerability
- CVE-2026-96857 Files or directories accessible to external parties in Windows Projected File System allows an authorized attacker to disclose information… vulnerability
- CVE-2026-108938 A flaw has been found in code-projects Matrimonial System 1.0. vulnerability
- CVE-2026-94375 The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,… vulnerability
- CVE-2026-100727 An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public… vulnerability
- CVE-2026-105750 Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. vulnerability
- CVE-2026-21589 This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center,… vulnerability
- CVE-2026-58415 Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all… vulnerability
- CVE-2026-71379 The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request. vulnerability
- CVE-2026-6544 IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion… vulnerability
- CVE-2026-15915 IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive information due to recursive copying of build context… vulnerability
- CVE-2026-77259 MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). vulnerability
- CVE-2026-88623 NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. vulnerability
- CVE-2026-54629 Anyquery is an SQL query engine built on top of SQLite. vulnerability
- CVE-2026-77884 Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. vulnerability
- CVE-2026-80494 The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a… vulnerability
Referenced by CWE · child of (8)
- CWE-219 Storage of File with Sensitive Data Under Web Root weakness
- CWE-220 Storage of File With Sensitive Data Under FTP Root weakness
- CWE-527 Exposure of Version-Control Repository to an Unauthorized Control Sphere weakness
- CWE-528 Exposure of Core Dump File to an Unauthorized Control Sphere weakness
- CWE-529 Exposure of Access Control List Files to an Unauthorized Control Sphere weakness
- CWE-530 Exposure of Backup File to an Unauthorized Control Sphere weakness
- CWE-539 Use of Persistent Cookies Containing Sensitive Information weakness
- CWE-553 Command Shell in Externally Accessible Directory weakness