CWE-552: Files or Directories Accessible to External Parties
Filter
The product makes files or directories accessible to unauthorized actors, even though they should not be.
What the weakness is: CWE-552 at MITRE
Ask an AI about CWE-552
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-552: Files or Directories Accessible to External Parties and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/552.html and https://cve.bz/cve/cwe/552?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.3CVE-2026-84172
Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the…
- 9.3CVE-2026-61730EPSS 0.4%
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated `/scoutsuite-report` `StaticFiles` mount in `backend/copilot.py` exposes the `scoutsuite-r…
- 4.8CVE-2026-119201EPSS 0.2%
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret, within a directory allowed by Vite's server.fs configuration.…
- 8.6CVE-2026-67073EPSS 0.2%
HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potenti…
- 4.9CVE-2026-65210EPSS 0.2%
This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role.
- 9.8CVE-2026-46651EPSS 0.4%
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer…
- 9.9CVE-2026-76531EPSS 0.4%
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discover…
- 8.2CVE-2026-114400EPSS 0.5%
Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guar…
- 4.2CVE-2026-87348EPSS 0.2%
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacke…
- 6.5CVE-2026-112948EPSS 0.4%
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles …
- 5.5CVE-2026-112144EPSS 0.5%
A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unknown part of the file project.sql. Executing a manipulation can lead to files or directories accessib…
- 8.2CVE-2026-102695EPSS 0.3%
OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that…
- 8.7CVE-2026-108070EPSS 0.4%
A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypas…
- 5.5CVE-2026-96857EPSS 0.4%
Files or directories accessible to external parties in Windows Projected File System allows an authorized attacker to disclose information locally.
- 6.5CVE-2026-88137EPSS 1.0%
Files or directories accessible to external parties in WebDAV allows an authorized attacker to disclose information over a network.
- 6.5CVE-2026-85840EPSS 1.0%
Files or directories accessible to external parties in Windows Event Viewer allows an authorized attacker to disclose information over a network.
- 5.5CVE-2026-85812EPSS 0.5%
Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally.
- 6.3CVE-2026-109162EPSS 0.4%
Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up in…
- 5.3CVE-2026-89118EPSS 0.2%
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Avai…
- 5.5CVE-2026-108938EPSS 0.3%
A flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown processing of the file db/matrimony.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exp…
- 5.3CVE-2026-94375EPSS 0.3%
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the get_file_path. This makes it possible for unauthenticated attackers to…
- 9.3CVE-2026-21589KEVExploitEPSS 99.4%
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability…
- 7.5CVE-2026-105750EPSS 0.4%
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._g…
- 6.9CVE-2026-100727EPSS 0.2%
An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".
- 5.3CVE-2026-58415EPSS 0.5%
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET…
- 10.0CVE-2026-71379EPSS 0.5%
The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.
- 6.2CVE-2026-6544EPSS 0.1%
IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of sensitive or unnecessary files and increased attack surface.
- 6.2CVE-2026-15915EPSS 0.2%
IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive information due to recursive copying of build context directories into container images.
- 7.7CVE-2026-77259EPSS 0.4%
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment opens a caller-selected server-local file without checking that the resolved path remains in…
- 7.5CVE-2026-88623EPSS 0.5%
NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen() is used to open the URL in binary read-only mode. The content is then written to t…
- 7.5CVE-2026-54629EPSS 1.0%
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port without authentication, aut…
- 7.1CVE-2026-77884EPSS 0.3%
Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files and directory listings from Android external storage.
- 8.6CVE-2026-80494EPSS 0.4%
The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download …
- 5.5CVE-2026-68831EPSS 0.6%
Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose information locally.
- 6.5CVE-2026-75164EPSS 0.6%
An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesy…
- 6.8CVE-2026-74853EPSS 0.4%
The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Onl…
- 9.2CVE-2026-67402EPSS 0.5%
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and …
- 8.7CVE-2026-85175EPSS 0.3%
SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/ke…
- 5.3CVE-2026-73736EPSS 0.4%
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files. Successful exploitation could allow an attacker to read files within the affe…
- 5.4CVE-2026-73735EPSS 0.3%
Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access some information beyond their privilege level. Successful exploitation could allow an attacker to obtain limite…
- 8.8CVE-2026-73705EPSS 0.6%
An arbitrary file write vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to ex…
- 7.6CVE-2026-82020EPSS 0.4%
Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the…
- 7.7CVE-2026-75889EPSS 0.2%
Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends…
- 8.1CVE-2026-53580EPSS 0.5%
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allow…
- 9.1CVE-2026-37065EPSS 0.5%
Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=.
- 7.5CVE-2026-75413EPSS 0.5%
DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath.
- 8.1CVE-2026-75464EPSS 0.5%
OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link().
- 5.5CVE-2026-78051EPSS 0.5%
A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the file /download/.metube/cookies.txt of the component Cookie File Handler. This manipulation causes files or directories a…
- 6.8CVE-2026-19093EPSS 0.5%
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The re…
- 7.7CVE-2026-54457EPSS 0.4%
TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/object_storage endpoint accepts a caller-supplied J…