CWE-552
AllowedFiles or Directories Accessible to External Parties
Abstraction: Base · Status: Draft
The product makes files or directories accessible to unauthorized actors, even though they should not be.
730 vulnerabilities reference this CWE, most recent first.
GHSA-66RX-339R-MM8J
Vulnerability from github – Published: 2023-02-06 15:30 – Updated: 2023-02-15 00:30CRMEB 4.4.4 is vulnerable to Any File download.
{
"affected": [],
"aliases": [
"CVE-2022-44343"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-06T14:15:00Z",
"severity": "HIGH"
},
"details": "CRMEB 4.4.4 is vulnerable to Any File download.",
"id": "GHSA-66rx-339r-mm8j",
"modified": "2023-02-15T00:30:39Z",
"published": "2023-02-06T15:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44343"
},
{
"type": "WEB",
"url": "https://gist.github.com/Nmslgkd/442d8055914887d7c99c4e70a63da4c2"
},
{
"type": "WEB",
"url": "https://github.com/crmeb/CRMEB"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-66VJ-P7RX-6JRR
Vulnerability from github – Published: 2022-01-19 00:00 – Updated: 2022-01-26 00:03An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possible by importing a group was due to incorrect handling of file.
{
"affected": [],
"aliases": [
"CVE-2022-0244"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-18T17:15:00Z",
"severity": "HIGH"
},
"details": "An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possible by importing a group was due to incorrect handling of file.",
"id": "GHSA-66vj-p7rx-6jrr",
"modified": "2022-01-26T00:03:10Z",
"published": "2022-01-19T00:00:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0244"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1439593"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0244.json"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/349524"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6769-R74J-4RX4
Vulnerability from github – Published: 2024-11-07 12:30 – Updated: 2024-11-07 12:30Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITE_DACL permission to the BUILTIN\Users group. This allows local users who are not administrators to grant themselves the Full Control permission on Velociraptor's files. By modifying Velociraptor's files, local users can subvert the binary and cause the Velociraptor service to execute arbitrary code as the SYSTEM user, or to replace the Velociraptor binary completely. This issue is fixed in version 0.73.3.
{
"affected": [],
"aliases": [
"CVE-2024-10526"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-07T11:15:03Z",
"severity": "HIGH"
},
"details": "Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITE_DACL permission to the BUILTIN\\\\Users group. This allows local users who are not administrators to grant themselves the Full Control permission on Velociraptor\u0027s files. By modifying Velociraptor\u0027s files, local users can subvert the binary and cause the Velociraptor service to execute arbitrary code as the SYSTEM user, or to replace the Velociraptor binary completely.\u00a0 This issue is fixed in version 0.73.3.",
"id": "GHSA-6769-r74j-4rx4",
"modified": "2024-11-07T12:30:35Z",
"published": "2024-11-07T12:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10526"
},
{
"type": "WEB",
"url": "https://docs.velociraptor.app/announcements/2024-cves"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:L/U:Red",
"type": "CVSS_V4"
}
]
}
GHSA-67Q5-5XJ6-VP4M
Vulnerability from github – Published: 2023-01-04 21:30 – Updated: 2024-10-16 12:30A Local File Inclusion vulnerability has been found in Axiell Iguana CMS. Due to insufficient neutralisation of user input on the url parameter on the imageProxy.type.php endpoint, external users are capable of accessing files on the server.
{
"affected": [],
"aliases": [
"CVE-2022-45052"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-04T19:15:00Z",
"severity": "MODERATE"
},
"details": "A Local File Inclusion vulnerability has been found in Axiell Iguana CMS. Due to insufficient neutralisation of user input on the url parameter on the imageProxy.type.php endpoint, external users are capable of accessing files on the server.",
"id": "GHSA-67q5-5xj6-vp4m",
"modified": "2024-10-16T12:30:47Z",
"published": "2023-01-04T21:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45052"
},
{
"type": "WEB",
"url": "https://csirt.divd.nl/CVE-2022-45052"
},
{
"type": "WEB",
"url": "https://csirt.divd.nl/DIVD-2022-00064"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-67QR-87V5-R3G3
Vulnerability from github – Published: 2025-02-12 18:31 – Updated: 2025-02-19 21:31In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), using .NET Standard 2.0, the contents of a file at an arbitrary path can be exported to RTF.
{
"affected": [],
"aliases": [
"CVE-2024-11629"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T17:15:22Z",
"severity": "HIGH"
},
"details": "In Progress\u00ae Telerik\u00ae Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), using .NET Standard 2.0, the contents of a file at an arbitrary path can be exported to RTF.",
"id": "GHSA-67qr-87v5-r3g3",
"modified": "2025-02-19T21:31:36Z",
"published": "2025-02-12T18:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11629"
},
{
"type": "WEB",
"url": "https://docs.telerik.com/devtools/document-processing/knowledge-base/kb-security-rtf-filecontent-export-cve-2024-11629"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-67X9-8JXX-85F8
Vulnerability from github – Published: 2025-05-30 09:30 – Updated: 2025-05-30 09:30The web portal on airpointer 2.4.107-2 was vulnerable local file inclusion. A malicious user with administrative privileges in the web portal would be able to manipulate requests to view files on the filesystem
{
"affected": [],
"aliases": [
"CVE-2025-4634"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-30T09:15:25Z",
"severity": "MODERATE"
},
"details": "The web portal on airpointer 2.4.107-2 was vulnerable local file inclusion. A malicious user with administrative privileges in the web portal would be able to manipulate requests to view files on the filesystem",
"id": "GHSA-67x9-8jxx-85f8",
"modified": "2025-05-30T09:30:27Z",
"published": "2025-05-30T09:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4634"
},
{
"type": "WEB",
"url": "https://jct-aq.com/products/airpointer2d"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-68W8-XMXR-X2GC
Vulnerability from github – Published: 2026-09-01 21:31 – Updated: 2026-09-01 21:31Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access some information beyond their privilege level. Successful exploitation could allow an attacker to obtain limited information and/or make limited changes beyond what is authorized by the user's existing privilege level.
{
"affected": [],
"aliases": [
"CVE-2026-73735"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-01T20:17:21Z",
"severity": "MODERATE"
},
"details": "Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access some information beyond their privilege level. Successful exploitation could allow an attacker to obtain limited information and/or make limited changes beyond what is authorized by the user\u0027s existing privilege level.",
"id": "GHSA-68w8-xmxr-x2gc",
"modified": "2026-09-01T21:31:49Z",
"published": "2026-09-01T21:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73735"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us\u0026docLocale=en_US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6974-V8M9-MMJ5
Vulnerability from github – Published: 2022-12-19 15:30 – Updated: 2022-12-23 18:30The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.
{
"affected": [],
"aliases": [
"CVE-2022-4106"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-19T14:15:00Z",
"severity": "HIGH"
},
"details": "The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.",
"id": "GHSA-6974-v8m9-mmj5",
"modified": "2022-12-23T18:30:40Z",
"published": "2022-12-19T15:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4106"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/b60a0d3d-148f-4e9b-baee-7332890804ed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-69H4-9VCF-3H5Q
Vulnerability from github – Published: 2022-05-24 17:07 – Updated: 2022-05-26 00:01An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter.
{
"affected": [],
"aliases": [
"CVE-2020-3927"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-03T11:15:00Z",
"severity": "HIGH"
},
"details": "An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter.",
"id": "GHSA-69h4-9vcf-3h5q",
"modified": "2022-05-26T00:01:12Z",
"published": "2022-05-24T17:07:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3927"
},
{
"type": "WEB",
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201910007"
},
{
"type": "WEB",
"url": "https://www.chtsecurity.com/news/1179d48b-7609-4f67-9d7e-3bac2979c6ce"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6C75-M6FQ-9MH7
Vulnerability from github – Published: 2023-01-03 00:30 – Updated: 2023-01-09 18:30The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server
{
"affected": [],
"aliases": [
"CVE-2022-4140"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-02T22:15:00Z",
"severity": "HIGH"
},
"details": "The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server",
"id": "GHSA-6c75-m6fq-9mh7",
"modified": "2023-01-09T18:30:17Z",
"published": "2023-01-03T00:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4140"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/0d649a7e-3334-48f7-abca-fff0856e12c7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
CAPEC-150: Collect Data from Common Resource Locations
An adversary exploits well-known locations for resources for the purposes of undermining the security of the target. In many, if not most systems, files and resources are organized in a default tree structure. This can be useful for adversaries because they often know where to look for resources or files that are necessary for attacks. Even when the precise location of a targeted resource may not be known, naming conventions may indicate a small area of the target machine's file tree where the resources are typically located. For example, configuration files are normally stored in the /etc director on Unix systems. Adversaries can take advantage of this to commit other types of attacks.
CAPEC-639: Probe System Files
An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.