CWE-553: Command Shell in Externally Accessible Directory
Filter
A possible shell file exists in /cgi-bin/ or other accessible directories. This is extremely dangerous and can be used by an attacker to execute commands on the web server.
What the weakness is: CWE-553 at MITRE. All weaknesses
Related attack patterns (CAPEC): 1
- CAPEC-650 Upload a Web Shell to a Web Server Severity: High
The attack patterns MITRE's CAPEC relates to CWE-553, as MITRE names them. Credits.
Ask an AI about CWE-553
Show the prompt
Explain CWE-553: Command Shell in Externally Accessible Directory and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/553.html and https://cve.bz/cve/cwe/553?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 8.6CVE-2025-66620EPSS 0.5%
An unused webshell in MicroServer allows unlimited login attempts, with sudo rights on certain files and directories. An attacker with admin access to MicroServer can gain limited shell access, enabling persistence through reverse shells, …