CWE-276
AllowedIncorrect Default Permissions
Abstraction: Base · Status: Draft
During installation, installed file permissions are set to allow anyone to modify those files.
2035 vulnerabilities reference this CWE, most recent first.
GHSA-JHWR-P2HQ-WWG6
Vulnerability from github – Published: 2021-11-18 00:00 – Updated: 2024-02-27 18:46Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit Integrated Sensor Hub driver pack before version 5.4.1.4449 may allow an authenticated user to potentially enable escalation of privilege via local access.
{
"affected": [],
"aliases": [
"CVE-2021-33088"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-17T19:15:00Z",
"severity": "HIGH"
},
"details": "Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit Integrated Sensor Hub driver pack before version 5.4.1.4449 may allow an authenticated user to potentially enable escalation of privilege via local access.",
"id": "GHSA-jhwr-p2hq-wwg6",
"modified": "2024-02-27T18:46:12Z",
"published": "2021-11-18T00:00:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33088"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00569.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JHXW-WGR6-6RQC
Vulnerability from github – Published: 2024-02-28 00:31 – Updated: 2024-02-28 00:31A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.
{
"affected": [],
"aliases": [
"CVE-2024-26302"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-27T23:15:07Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager.\n\n",
"id": "GHSA-jhxw-wgr6-6rqc",
"modified": "2024-02-28T00:31:55Z",
"published": "2024-02-28T00:31:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26302"
},
{
"type": "WEB",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-001.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JJ2R-455P-5GVF
Vulnerability from github – Published: 2025-06-27 14:55 – Updated: 2025-08-04 20:31Summary
The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the database used by File Browser. On standard servers where the umask configuration has not been hardened before, this makes all the stated files readable by any operating system account.
Impact
The default permissions for new files on a standard Linux system are 0644, making them world-readable.
That means that at least the following parties have full read access to all files managed by the Filebrowser from all scopes, as well as its database (including the password hashes stored in there):
- All OS accounts on the server
- All other applications running on the same server
- Any Filebrowser user with Command Execution privileges having access to a command that allows reading a file's content
Vulnerability Description
On a Linux system, the file access permissions of new files are designated by the system wide umask setting, unless they are configured manually.
Most distributions set this value to 022 by default which gives every account on the system read permissions on the file.
$ umask
022
$ touch foo
$ ls -l foo
-rw-r--r-- 1 sba sba 0 31. Mär 15:08 foo
Proof of Concept
Upload or create a file in the Filebrowser GUI and list the directory contents from a shell:
$ ls -l /srv/filebrowser/testdir
total 12
-rw-r--r-- 1 sba sba 7703 Mar 25 16:07 dummy1.pdf
-rw-r--r-- 1 sba sba 3 Mar 25 15:46 testfile.txt
The same can be validated for Docker based deployments within the container:
$ docker exec -it e0f075082a2c ls /srv/testdir -l
total 12
-rw-r--r-- 1 1000 1000 7703 Mar 25 15:07 dummy1.pdf
-rw-r--r-- 1 1000 1000 3 Mar 25 14:46 testfile.txt
Furthermore, the database used by the Filebrowser application is readable by any account:
$ ls -l /srv/filebrowser/filebrowser.db
-rw-rw-r-- 1 sba sba 65536 Mar 25 09:58 /srv/filebrowser/filebrowser.db
Recommended Countermeasures
Since the system's umask configuration cannot be controlled by the Filebrowser, the application needs to set the permissions of all new files manually upon creation. No permissions should be given to the other category.
Implementing this won't fix the permissions for active instances after an update, so site administrators will need to fix the permissions manually:
$ chmod o-rwx -R /srv/filebrowser/datadir
Timeline
2025-03-25Identified the vulnerability in version 2.32.02025-04-11Contacted the project2025-04-18Vulnerability disclosed to the project2025-06-25Uploaded advisories to the project's GitHub repository2025-06-26CVE ID assigned by GitHub2025-06-26Fix released with version 2.33.7
References
- CWE-276: Incorrect Default Permissions
- What is Umask and How To Setup Default umask Under Linux?
- Original Advisory
Credits
- Mathias Tausig (SBA Research)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/filebrowser/filebrowser/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.33.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/filebrowser/filebrowser"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.11.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-52900"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-27T14:55:07Z",
"nvd_published_at": "2025-06-26T15:15:23Z",
"severity": "MODERATE"
},
"details": "## Summary ##\n\nThe file access permissions for files uploaded to or created from File Browser are never explicitly set by the application.\nThe same is true for the database used by File Browser. On standard servers where the *umask* configuration has not been hardened before, this makes all the stated files readable by any operating system account.\n\n## Impact ##\n\nThe default permissions for new files on a standard Linux system are `0644`, making them world-readable.\nThat means that at least the following parties have full read access to all files managed by the Filebrowser from all *scopes*, as well as its database (including the password hashes stored in there):\n\n* All OS accounts on the server\n* All other applications running on the same server\n* Any Filebrowser user with *Command Execution* privileges having access to a command that allows reading a file\u0027s content\n\n## Vulnerability Description ##\n\nOn a Linux system, the file access permissions of new files are designated by the system wide *umask* setting, unless they are configured manually.\nMost distributions set this value to `022` by default which gives every account on the system read permissions on the file.\n\n```bash\n$ umask\n022\n$ touch foo\n$ ls -l foo\n-rw-r--r-- 1 sba sba 0 31. M\u00e4r 15:08 foo\n```\n\n## Proof of Concept ##\n\nUpload or create a file in the Filebrowser GUI and list the directory contents from a shell:\n\n```bash\n$ ls -l /srv/filebrowser/testdir\ntotal 12\n-rw-r--r-- 1 sba sba 7703 Mar 25 16:07 dummy1.pdf\n-rw-r--r-- 1 sba sba 3 Mar 25 15:46 testfile.txt\n```\n\nThe same can be validated for Docker based deployments within the container:\n\n```bash\n$ docker exec -it e0f075082a2c ls /srv/testdir -l\ntotal 12\n-rw-r--r-- 1 1000 1000 7703 Mar 25 15:07 dummy1.pdf\n-rw-r--r-- 1 1000 1000 3 Mar 25 14:46 testfile.txt\n```\n\nFurthermore, the database used by the Filebrowser application is readable by any account:\n\n```bash\n$ ls -l /srv/filebrowser/filebrowser.db \n-rw-rw-r-- 1 sba sba 65536 Mar 25 09:58 /srv/filebrowser/filebrowser.db\n```\n\n## Recommended Countermeasures ##\n\nSince the system\u0027s *umask* configuration cannot be controlled by the Filebrowser, the application needs to set the permissions of all new files manually upon creation.\nNo permissions should be given to the *other* category.\n\nImplementing this won\u0027t fix the permissions for active instances after an update, so site administrators will need to fix the permissions manually:\n\n```bash\n$ chmod o-rwx -R /srv/filebrowser/datadir\n```\n\n## Timeline ##\n\n* `2025-03-25` Identified the vulnerability in version 2.32.0\n* `2025-04-11` Contacted the project\n* `2025-04-18` Vulnerability disclosed to the project\n* `2025-06-25` Uploaded advisories to the project\u0027s GitHub repository\n* `2025-06-26` CVE ID assigned by GitHub\n* `2025-06-26` Fix released with version 2.33.7\n\n## References ##\n\n* [CWE-276: Incorrect Default Permissions](https://cwe.mitre.org/data/definitions/276.html)\n* [What is Umask and How To Setup Default umask Under Linux?](https://www.cyberciti.biz/tips/understanding-linux-unix-umask-value-usage.html)\n* [Original Advisory](https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250325-03_Filebrowser_Insecure_File_Permissions)\n\n## Credits ##\n\n* Mathias Tausig ([SBA Research](https://www.sba-research.org/))",
"id": "GHSA-jj2r-455p-5gvf",
"modified": "2025-08-04T20:31:25Z",
"published": "2025-06-27T14:55:07Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-jj2r-455p-5gvf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52900"
},
{
"type": "WEB",
"url": "https://github.com/filebrowser/filebrowser/commit/ca86f916216620365c0f81629c0934ce02574d76"
},
{
"type": "PACKAGE",
"url": "https://github.com/filebrowser/filebrowser"
},
{
"type": "WEB",
"url": "https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250325-03_Filebrowser_Insecure_File_Permissions"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2025-3785"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "filebrowser Sets Insecure File Permissions"
}
GHSA-JJ6M-4XX6-2VRF
Vulnerability from github – Published: 2025-08-18 21:31 – Updated: 2025-08-18 21:31An improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges.
{
"affected": [],
"aliases": [
"CVE-2025-8098"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-18T20:15:31Z",
"severity": "HIGH"
},
"details": "An improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges.",
"id": "GHSA-jj6m-4xx6-2vrf",
"modified": "2025-08-18T21:31:21Z",
"published": "2025-08-18T21:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8098"
},
{
"type": "WEB",
"url": "https://iknow.lenovo.com.cn/detail/430658"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JM27-CHWJ-2652
Vulnerability from github – Published: 2022-05-13 01:17 – Updated: 2022-05-13 01:17SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting of files within the Compass installation folder, resulting in escalation of privilege and/or malicious code execution.
{
"affected": [],
"aliases": [
"CVE-2018-10604"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-24T13:29:00Z",
"severity": "HIGH"
},
"details": "SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting of files within the Compass installation folder, resulting in escalation of privilege and/or malicious code execution.",
"id": "GHSA-jm27-chwj-2652",
"modified": "2022-05-13T01:17:46Z",
"published": "2022-05-13T01:17:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10604"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-191-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JMGG-9RVF-M69W
Vulnerability from github – Published: 2026-07-09 18:31 – Updated: 2026-07-09 18:31[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464
{
"affected": [],
"aliases": [
"CVE-2025-27464"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-09T16:16:33Z",
"severity": "CRITICAL"
},
"details": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464",
"id": "GHSA-jmgg-9rvf-m69w",
"modified": "2026-07-09T18:31:50Z",
"published": "2026-07-09T18:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27464"
},
{
"type": "WEB",
"url": "https://xenbits.xen.org/xsa/advisory-468.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JMVG-77XW-264G
Vulnerability from github – Published: 2022-05-13 01:44 – Updated: 2025-04-20 03:48MitraStar GPT-2541GNAC (HGU) 1.00(VNJ0)b1 and DSL-100HN-T1 ES_113WJY0b16 devices allow remote authenticated users to obtain root access by specifying /bin/sh as the command to execute.
{
"affected": [],
"aliases": [
"CVE-2017-16522"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-03T17:29:00Z",
"severity": "HIGH"
},
"details": "MitraStar GPT-2541GNAC (HGU) 1.00(VNJ0)b1 and DSL-100HN-T1 ES_113WJY0b16 devices allow remote authenticated users to obtain root access by specifying /bin/sh as the command to execute.",
"id": "GHSA-jmvg-77xw-264g",
"modified": "2025-04-20T03:48:02Z",
"published": "2022-05-13T01:44:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16522"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/files/144805/MitraStar-DSL-100HN-T1-GPT-2541GNAC-Privilege-Escalation.html"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/43061"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JP46-X3HQ-VCRM
Vulnerability from github – Published: 2022-03-11 00:02 – Updated: 2022-03-17 00:01Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an unspecified impact.
{
"affected": [],
"aliases": [
"CVE-2021-44215"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-10T17:44:00Z",
"severity": "MODERATE"
},
"details": "Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an unspecified impact.",
"id": "GHSA-jp46-x3hq-vcrm",
"modified": "2022-03-17T00:01:45Z",
"published": "2022-03-11T00:02:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44215"
},
{
"type": "WEB",
"url": "https://cfengine.com/blog/2022/cve-2021-44215-and-cve-2021-44216"
},
{
"type": "WEB",
"url": "https://northern.tech"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JP9F-72XX-W236
Vulnerability from github – Published: 2022-05-17 19:57 – Updated: 2024-04-04 00:01SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to change the permissions of arbitrary files by executing /opt/sgi/sgimc/bin/vx.
{
"affected": [],
"aliases": [
"CVE-2014-7302"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-01-27T18:15:00Z",
"severity": "HIGH"
},
"details": "SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to change the permissions of arbitrary files by executing /opt/sgi/sgimc/bin/vx.",
"id": "GHSA-jp9f-72xx-w236",
"modified": "2024-04-04T00:01:02Z",
"published": "2022-05-17T19:57:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7302"
},
{
"type": "WEB",
"url": "https://labs.mwrinfosecurity.com/advisories/2014/12/02/sgi-suid-root-privilege-escalation"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/129465/SGI-Tempo-vx-Setuid-Privilege-Escalation.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JPF2-9PPP-2C49
Vulnerability from github – Published: 2024-11-11 15:31 – Updated: 2024-11-12 21:25A flaw was found in moodle. External API access to Quiz can override contained insufficient access control.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-43430"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": true,
"github_reviewed_at": "2024-11-12T21:25:09Z",
"nvd_published_at": "2024-11-11T13:15:04Z",
"severity": "LOW"
},
"details": "A flaw was found in moodle. External API access to Quiz can override contained insufficient access control.",
"id": "GHSA-jpf2-9ppp-2c49",
"modified": "2024-11-12T21:25:09Z",
"published": "2024-11-11T15:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43430"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2304258"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=461198"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-82633"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Moodle has insufficient access control"
}
Mitigation MIT-1
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
Mitigation MIT-46
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-127: Directory Indexing
An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
CAPEC-81: Web Server Logs Tampering
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.