CWEweakness

CWE-553 Command Shell in Externally Accessible Directory

Official page ↗
Abstraction
Variant
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

A possible shell file exists in /cgi-bin/ or other accessible directories. This is extremely dangerous and can be used by an attacker to execute commands on the web server.

Common consequences

• Confidentiality, Integrity, Availability: Execute Unauthorized Code or Commands

Potential mitigations

• [Installation, System Configuration] Remove any Shells accessible under the web root folder and children directories.

Related

Attack pattern · CAPEC (1)

  • CAPEC-650 Upload a Web Shell to a Web Server attack pattern

Child of · CWE (1)

  • CWE-552 Files or Directories Accessible to External Parties weakness

Referenced by CAPEC · weakness (1)

  • CAPEC-650 Upload a Web Shell to a Web Server attack pattern

Referenced by CVE · weakness (1)

  • CVE-2025-66620 An unused webshell in MicroServer allows unlimited login attempts, with sudo rights on certain files and directories. vulnerability