CWE-552
AllowedFiles or Directories Accessible to External Parties
Abstraction: Base · Status: Draft
The product makes files or directories accessible to unauthorized actors, even though they should not be.
730 vulnerabilities reference this CWE, most recent first.
GHSA-JJQ4-4RFQ-9948
Vulnerability from github – Published: 2022-05-20 00:00 – Updated: 2022-05-27 00:00Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress.
{
"affected": [],
"aliases": [
"CVE-2022-29446"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-19T16:15:00Z",
"severity": "HIGH"
},
"details": "Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company\u0027s Counter Box plugin \u003c= 1.1.1 at WordPress.",
"id": "GHSA-jjq4-4rfq-9948",
"modified": "2022-05-27T00:00:33Z",
"published": "2022-05-20T00:00:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29446"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/counter-box/wordpress-counter-box-plugin-1-1-1-authenticated-local-file-inclusion-lfi-vulnerability"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/counter-box/#developers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JMQ8-HG35-36H2
Vulnerability from github – Published: 2026-08-20 18:30 – Updated: 2026-08-24 18:31Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/12161 .
{
"affected": [],
"aliases": [
"CVE-2026-63042"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-20T16:17:30Z",
"severity": "HIGH"
},
"details": "Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions.\n\nThis issue affects Apache InLong: from 2.0.0 before 2.4.0.\n\n\n\nUsers are advised to upgrade to Apache InLong\u0027s 2.4.0 or cherry-pick [1] to solve it.\n\n[1]\u00a0 https://github.com/apache/inlong/pull/12161 .",
"id": "GHSA-jmq8-hg35-36h2",
"modified": "2026-08-24T18:31:39Z",
"published": "2026-08-20T18:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63042"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/wxs4jfjkoo6rlyovhrx8bo74rfmzwbk7"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/08/20/15"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JQ72-627Q-5JFJ
Vulnerability from github – Published: 2025-10-13 06:32 – Updated: 2025-10-21 15:30HCL Unica Platform is affected by unprotected files due to improper access controls. These files may contain sensitive information such as private or system information that can be exploited by attackers to compromise the application, infrastructure, or users.
{
"affected": [],
"aliases": [
"CVE-2025-31996"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-13T04:15:56Z",
"severity": "MODERATE"
},
"details": "HCL Unica Platform is affected by unprotected files due to improper access controls. \u00a0These files may contain sensitive information such as private or system information that can be exploited by attackers to compromise the application, infrastructure, or users.",
"id": "GHSA-jq72-627q-5jfj",
"modified": "2025-10-21T15:30:55Z",
"published": "2025-10-13T06:32:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31996"
},
{
"type": "WEB",
"url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0124418"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JQVR-GMGR-WG44
Vulnerability from github – Published: 2022-05-24 17:06 – Updated: 2022-05-24 17:06The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. This might allow attackers to read ZIP archives by guessing random ID numbers, guessing date strings with a 2020_{0..1}{0..2}_{0..3}{0..9} format, guessing UNIX timestamps, and making HTTPS requests with the complete guessed URL.
{
"affected": [],
"aliases": [
"CVE-2020-7241"
],
"database_specific": {
"cwe_ids": [
"CWE-330",
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-01-20T20:15:00Z",
"severity": "MODERATE"
},
"details": "The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. This might allow attackers to read ZIP archives by guessing random ID numbers, guessing date strings with a 2020_{0..1}{0..2}_{0..3}{0..9} format, guessing UNIX timestamps, and making HTTPS requests with the complete guessed URL.",
"id": "GHSA-jqvr-gmgr-wg44",
"modified": "2022-05-24T17:06:56Z",
"published": "2022-05-24T17:06:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7241"
},
{
"type": "WEB",
"url": "https://github.com/V1n1v131r4/Exploiting-WP-Database-Backup-WordPress-Plugin/blob/master/README.md"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/wp-database-backup/#developers"
},
{
"type": "WEB",
"url": "https://zeroauth.ltd/blog/2020/01/21/analysis-on-cve-2020-7241-misrepresenting-a-security-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JRH7-FGHQ-G8XM
Vulnerability from github – Published: 2022-02-08 00:00 – Updated: 2022-02-12 00:01The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server without restriction after knowing the URL and a password than an administrator can see in the plugin settings page.
{
"affected": [],
"aliases": [
"CVE-2021-25004"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-07T16:15:00Z",
"severity": "MODERATE"
},
"details": "The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server without restriction after knowing the URL and a password than an administrator can see in the plugin settings page.",
"id": "GHSA-jrh7-fghq-g8xm",
"modified": "2022-02-12T00:01:07Z",
"published": "2022-02-08T00:00:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25004"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/cfbc2b43-b8f8-4bcb-a3d3-39d217afa530"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JRP8-VQ3H-W34W
Vulnerability from github – Published: 2025-02-07 18:31 – Updated: 2025-02-10 18:30Directory Traversal vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the File Listing function.
{
"affected": [],
"aliases": [
"CVE-2024-55213"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-07T16:15:37Z",
"severity": "HIGH"
},
"details": "Directory Traversal vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the File Listing function.",
"id": "GHSA-jrp8-vq3h-w34w",
"modified": "2025-02-10T18:30:46Z",
"published": "2025-02-07T18:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55213"
},
{
"type": "WEB",
"url": "https://dhtmlx.com/docs/products/demoApps/dhtmlxFileExplorerDemo"
},
{
"type": "WEB",
"url": "https://packetstorm.news/files/id/189020"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-JXM6-82V5-5M3H
Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2023-11-15 21:35Incorrect access to deleted scripts vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to gain access to signed SQL scripts which have been marked as deleted or expired within the administrative console. This access was only available through the REST API.
{
"affected": [],
"aliases": [
"CVE-2021-31831"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-03T10:15:00Z",
"severity": "HIGH"
},
"details": "Incorrect access to deleted scripts vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to gain access to signed SQL scripts which have been marked as deleted or expired within the administrative console. This access was only available through the REST API.",
"id": "GHSA-jxm6-82v5-5m3h",
"modified": "2023-11-15T21:35:01Z",
"published": "2022-05-24T19:03:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31831"
},
{
"type": "WEB",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10359"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-M273-6V24-X4M4
Vulnerability from github – Published: 2025-12-29 15:22 – Updated: 2026-06-18 14:44Summary
Picklescan has got open() and shutil in its default dangerous blocklist to prevent arbitrary file overwrites. However the module distutils isnt blocked and can be used for the same purpose ie to write arbitrary files.
Details
This is another vulnerability which impacts the downstream user.
By constructing a pickle that user distutils.file_util.write_file, an attacker can overwrite critical system files (like .ssh/authorized_keys, web server configurations, or source code) to achieve DoS or escalate to RCE.
PoC
import pickle
import distutils.file_util
class FileWriteBypass:
def __reduce__(self):
target_file = "pwned_config.env"
content = ["print('I have overwritten your config')"]
return (distutils.file_util.write_file, (target_file, content))
payload = pickle.dumps(FileWriteBypass())
with open("bypass_filewrite.pkl", "wb") as f:
f.write(payload)
print("bypass_filewrite.pkl")
To fix this just add disutil to the blacklist
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "picklescan"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.33"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-71321"
],
"database_specific": {
"cwe_ids": [
"CWE-502",
"CWE-552"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-29T15:22:30Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nPicklescan has got open() and shutil in its default dangerous blocklist to prevent arbitrary file overwrites. However the module distutils isnt blocked and can be used for the same purpose ie to write arbitrary files.\n\n### Details\nThis is another vulnerability which impacts the downstream user.\n\nBy constructing a pickle that user distutils.file_util.write_file, an attacker can overwrite critical system files (like .ssh/authorized_keys, web server configurations, or source code) to achieve DoS or escalate to RCE.\n\n### PoC\n```python\nimport pickle\nimport distutils.file_util\n\nclass FileWriteBypass:\n def __reduce__(self):\n \n target_file = \"pwned_config.env\"\n content = [\"print(\u0027I have overwritten your config\u0027)\"]\n \n return (distutils.file_util.write_file, (target_file, content))\n\npayload = pickle.dumps(FileWriteBypass())\nwith open(\"bypass_filewrite.pkl\", \"wb\") as f:\n f.write(payload)\n\nprint(\"bypass_filewrite.pkl\")\n```\n\n\u003cimg width=\"853\" height=\"197\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a129f5aa-a050-4e88-adb7-5a6f93e35b65\" /\u003e\n\nTo fix this just add disutil to the blacklist",
"id": "GHSA-m273-6v24-x4m4",
"modified": "2026-06-18T14:44:27Z",
"published": "2025-12-29T15:22:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-m273-6v24-x4m4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71321"
},
{
"type": "WEB",
"url": "https://github.com/mmaitre314/picklescan/pull/53"
},
{
"type": "WEB",
"url": "https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab"
},
{
"type": "PACKAGE",
"url": "https://github.com/mmaitre314/picklescan"
},
{
"type": "WEB",
"url": "https://github.com/mmaitre314/picklescan/releases/tag/v0.0.33"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/picklescan-arbitrary-file-writing-via-distutils-module-bypass"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "Picklescan vulnerable to Arbitrary File Writing"
}
GHSA-M2MX-4JC6-3WH7
Vulnerability from github – Published: 2022-05-13 01:08 – Updated: 2022-05-13 01:08The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.
{
"affected": [],
"aliases": [
"CVE-2015-1350"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-05-02T10:59:00Z",
"severity": "MODERATE"
},
"details": "The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.",
"id": "GHSA-m2mx-4jc6-3wh7",
"modified": "2022-05-13T01:08:47Z",
"published": "2022-05-13T01:08:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1350"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770492"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1185139"
},
{
"type": "WEB",
"url": "http://marc.info/?l=linux-kernel\u0026m=142153722930533\u0026w=2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/01/24/5"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/76075"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M3F3-PC2W-56JQ
Vulnerability from github – Published: 2023-09-27 15:30 – Updated: 2024-04-04 07:54Dreamer CMS v4.1.3 was discovered to contain an arbitrary file read vulnerability via the component /admin/TemplateController.java.
{
"affected": [],
"aliases": [
"CVE-2023-43856"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-27T15:19:34Z",
"severity": "HIGH"
},
"details": "Dreamer CMS v4.1.3 was discovered to contain an arbitrary file read vulnerability via the component /admin/TemplateController.java.",
"id": "GHSA-m3f3-pc2w-56jq",
"modified": "2024-04-04T07:54:57Z",
"published": "2023-09-27T15:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43856"
},
{
"type": "WEB",
"url": "https://github.com/yux1azhengye"
},
{
"type": "WEB",
"url": "https://github.com/yux1azhengye/mycve/blob/main/DreamerCMS%20arbitrary%20file%20reading.pdf"
},
{
"type": "WEB",
"url": "http://cms.iteachyou.cc"
},
{
"type": "WEB",
"url": "http://dreamer.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
CAPEC-150: Collect Data from Common Resource Locations
An adversary exploits well-known locations for resources for the purposes of undermining the security of the target. In many, if not most systems, files and resources are organized in a default tree structure. This can be useful for adversaries because they often know where to look for resources or files that are necessary for attacks. Even when the precise location of a targeted resource may not be known, naming conventions may indicate a small area of the target machine's file tree where the resources are typically located. For example, configuration files are normally stored in the /etc director on Unix systems. Adversaries can take advantage of this to commit other types of attacks.
CAPEC-639: Probe System Files
An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.