CWE-552
AllowedFiles or Directories Accessible to External Parties
Abstraction: Base · Status: Draft
The product makes files or directories accessible to unauthorized actors, even though they should not be.
752 vulnerabilities reference this CWE, most recent first.
GHSA-7GVX-RVMQ-CW57
Vulnerability from github – Published: 2025-05-19 06:30 – Updated: 2025-05-19 06:30A vulnerability classified as critical was found in SourceCodester Client Database Management System 1.0. This vulnerability affects unknown code. The manipulation leads to exposure of information through directory listing. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
{
"affected": [],
"aliases": [
"CVE-2025-4909"
],
"database_specific": {
"cwe_ids": [
"CWE-548",
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-19T04:15:42Z",
"severity": "MODERATE"
},
"details": "A vulnerability classified as critical was found in SourceCodester Client Database Management System 1.0. This vulnerability affects unknown code. The manipulation leads to exposure of information through directory listing. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
"id": "GHSA-7gvx-rvmq-cw57",
"modified": "2025-05-19T06:30:35Z",
"published": "2025-05-19T06:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4909"
},
{
"type": "WEB",
"url": "https://github.com/dengxun628/cve/issues/3"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.309466"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.309466"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.578723"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7QQR-WWJQ-98V6
Vulnerability from github – Published: 2022-09-29 00:00 – Updated: 2022-10-01 00:00When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.
{
"affected": [],
"aliases": [
"CVE-2022-3287"
],
"database_specific": {
"cwe_ids": [
"CWE-256",
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-28T20:15:00Z",
"severity": "MODERATE"
},
"details": "When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.",
"id": "GHSA-7qqr-wwjq-98v6",
"modified": "2022-10-01T00:00:21Z",
"published": "2022-09-29T00:00:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3287"
},
{
"type": "WEB",
"url": "https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7R68-66H2-V7F6
Vulnerability from github – Published: 2022-05-24 19:15 – Updated: 2022-06-29 00:00The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance.
{
"affected": [],
"aliases": [
"CVE-2021-22015"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-23T13:15:00Z",
"severity": "HIGH"
},
"details": "The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance.",
"id": "GHSA-7r68-66h2-v7f6",
"modified": "2022-06-29T00:00:44Z",
"published": "2022-05-24T19:15:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22015"
},
{
"type": "WEB",
"url": "https://www.vmware.com/security/advisories/VMSA-2021-0020.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/170116/VMware-vCenter-vScalation-Privilege-Escalation.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7V2G-87XJ-PJH4
Vulnerability from github – Published: 2026-10-13 03:30 – Updated: 2026-10-13 03:30SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Availability of the application.
{
"affected": [],
"aliases": [
"CVE-2026-89118"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T01:16:48Z",
"severity": "MODERATE"
},
"details": "SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Availability of the application.",
"id": "GHSA-7v2g-87xj-pjh4",
"modified": "2026-10-13T03:30:31Z",
"published": "2026-10-13T03:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89118"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3789825"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7VC2-X95V-G6M9
Vulnerability from github – Published: 2026-06-22 15:30 – Updated: 2026-06-22 18:34GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration could occur if there is indirect prompt injection.
{
"affected": [],
"aliases": [
"CVE-2025-66389"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-22T14:16:24Z",
"severity": "HIGH"
},
"details": "GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration could occur if there is indirect prompt injection.",
"id": "GHSA-7vc2-x95v-g6m9",
"modified": "2026-06-22T18:34:11Z",
"published": "2026-06-22T15:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66389"
},
{
"type": "WEB",
"url": "https://blindcyber.com/2025/10/28/copilot-fun"
},
{
"type": "WEB",
"url": "https://github.com/microsoft/vscode-copilot-chat"
},
{
"type": "WEB",
"url": "https://github.com/microsoft/vscode/blob/03baef1008086ed4960042fa463e570072173bb5/src/vs/workbench/contrib/chat/electron-browser/tools/fetchPageTool.ts#L152"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7XFV-PF6F-P6V2
Vulnerability from github – Published: 2023-08-04 00:30 – Updated: 2025-05-19 21:30Insecure access control in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read sensitive backup files and access sensitive information such as user credentials via sending a crafted HTTP request to the static files resources of the system.
{
"affected": [],
"aliases": [
"CVE-2023-38952"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-03T23:15:11Z",
"severity": "HIGH"
},
"details": "Insecure access control in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read sensitive backup files and access sensitive information such as user credentials via sending a crafted HTTP request to the static files resources of the system.",
"id": "GHSA-7xfv-pf6f-p6v2",
"modified": "2025-05-19T21:30:27Z",
"published": "2023-08-04T00:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38952"
},
{
"type": "WEB",
"url": "https://claroty.com/team82/disclosure-dashboard/cve-2023-38952"
},
{
"type": "WEB",
"url": "https://github.com/omair2084/biotime-rce-8.5.5/blob/main/biotime_enum.py"
},
{
"type": "WEB",
"url": "https://krashconsulting.com/fury-of-fingers-biotime-rce"
},
{
"type": "WEB",
"url": "https://sploitus.com/exploit?id=PACKETSTORM:177859"
},
{
"type": "WEB",
"url": "http://zkteco.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7XRV-JV66-7Q59
Vulnerability from github – Published: 2022-07-07 00:00 – Updated: 2026-07-05 03:30IOBit Advanced System Care (Asc.exe) 15 and Action Download Center both download components of IOBit suite into ProgramData folder, ProgramData folder has "rwx" permissions for unprivileged users. Low privilege users can use SetOpLock to wait for CreateProcess and switch the genuine component with a malicious executable thus gaining code execution as a high privilege user (Low Privilege -> high integrity ADMIN).
{
"affected": [],
"aliases": [
"CVE-2022-24138"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-06T13:15:00Z",
"severity": "HIGH"
},
"details": "IOBit Advanced System Care (Asc.exe) 15 and Action Download Center both download components of IOBit suite into ProgramData folder, ProgramData folder has \"rwx\" permissions for unprivileged users. Low privilege users can use SetOpLock to wait for CreateProcess and switch the genuine component with a malicious executable thus gaining code execution as a high privilege user (Low Privilege -\u003e high integrity ADMIN).",
"id": "GHSA-7xrv-jv66-7q59",
"modified": "2026-07-05T03:30:49Z",
"published": "2022-07-07T00:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24138"
},
{
"type": "WEB",
"url": "https://github.com/tomerpeled92/CVE"
},
{
"type": "WEB",
"url": "http://advanced.com"
},
{
"type": "WEB",
"url": "http://iobit.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-824W-X939-6CMC
Vulnerability from github – Published: 2026-07-15 21:59 – Updated: 2026-07-15 21:59Impact
The /internal/object_storage endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the TensorZero [object_storage] configuration.
By abusing the filesystem storage type, a caller can read arbitrary files from the gateway filesystem, including files that may contain sensitive credentials. Similarly, by abusing the s3_compatible storage type, the caller can coerce the gateway into making outbound object storage requests to attacker-chosen internal/cloud-metadata endpoints.
This vulnerability only applies when the gateway can be accessed by untrusted callers. If a developer's TensorZero deployment has authentication enabled, only authenticated callers can exploit this vulnerability. If a developer's deployment has authentication disabled, any caller can exploit this vulnerability.
Remediation
The vulnerability has been patched in version 2026.6.0. See PR #7527.
Workarounds
If developers are unable to upgrade a gateway that is exposed to untrusted callers, please block external access to the /internal/object_storage endpoint.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "tensorzero"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54457"
],
"database_specific": {
"cwe_ids": [
"CWE-552",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-15T21:59:40Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\n\nThe `/internal/object_storage` endpoint accepts a caller-supplied JSON `storage_path` parameter that dynamically overrides the TensorZero `[object_storage]` configuration.\n\nBy abusing the `filesystem` storage type, a caller can read arbitrary files from the gateway filesystem, including files that may contain sensitive credentials. Similarly, by abusing the `s3_compatible` storage type, the caller can coerce the gateway into making outbound object storage requests to attacker-chosen internal/cloud-metadata endpoints.\n\nThis vulnerability only applies when the gateway can be accessed by untrusted callers. If a developer\u0027s TensorZero deployment has authentication enabled, only authenticated callers can exploit this vulnerability. If a developer\u0027s deployment has authentication disabled, any caller can exploit this vulnerability.\n\n### Remediation\n\nThe vulnerability has been patched in version `2026.6.0`. See PR #7527.\n\n### Workarounds\n\nIf developers are unable to upgrade a gateway that is exposed to untrusted callers, please block external access to the `/internal/object_storage` endpoint.",
"id": "GHSA-824w-x939-6cmc",
"modified": "2026-07-15T21:59:40Z",
"published": "2026-07-15T21:59:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tensorzero/tensorzero/security/advisories/GHSA-824w-x939-6cmc"
},
{
"type": "WEB",
"url": "https://github.com/tensorzero/tensorzero/commit/0abbc838bae3394fe7491dad7009670d4e3b6cf8"
},
{
"type": "PACKAGE",
"url": "https://github.com/tensorzero/tensorzero"
},
{
"type": "WEB",
"url": "https://github.com/tensorzero/tensorzero/releases/tag/2026.6.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint"
}
GHSA-82H9-WXQP-J6PQ
Vulnerability from github – Published: 2022-05-24 17:09 – Updated: 2024-04-04 02:48The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote administrators of Dropbox.com to read arbitrary files via an @ (at sign) character in unspecified POST values.
{
"affected": [],
"aliases": [
"CVE-2015-4715"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-17T19:15:00Z",
"severity": "MODERATE"
},
"details": "The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote administrators of Dropbox.com to read arbitrary files via an @ (at sign) character in unspecified POST values.",
"id": "GHSA-82h9-wxqp-j6pq",
"modified": "2024-04-04T02:48:06Z",
"published": "2022-05-24T17:09:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4715"
},
{
"type": "WEB",
"url": "https://github.com/owncloud/core/commit/bf0f1a50926a75a26a42a3da4d62e84a489ee77a"
},
{
"type": "WEB",
"url": "https://owncloud.org/security/advisories/mounted-dropbox-storage-allows-dropbox-com-access-file"
},
{
"type": "WEB",
"url": "https://owncloud.org/security/advisory/?id=oc-sa-2015-005"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/76158"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-867M-9P4W-343P
Vulnerability from github – Published: 2022-07-23 00:00 – Updated: 2022-07-29 00:00Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.
{
"affected": [],
"aliases": [
"CVE-2022-33901"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-22T17:15:00Z",
"severity": "HIGH"
},
"details": "Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin \u003c= 4.13.1 at WordPress.",
"id": "GHSA-867m-9p4w-343p",
"modified": "2022-07-29T00:00:19Z",
"published": "2022-07-23T00:00:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-33901"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/multisafepay/wordpress-multisafepay-plugin-for-woocommerce-plugin-4-13-1-unauthenticated-arbitrary-file-read-vulnerability"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/multisafepay/#developers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
CAPEC-150: Collect Data from Common Resource Locations
An adversary exploits well-known locations for resources for the purposes of undermining the security of the target. In many, if not most systems, files and resources are organized in a default tree structure. This can be useful for adversaries because they often know where to look for resources or files that are necessary for attacks. Even when the precise location of a targeted resource may not be known, naming conventions may indicate a small area of the target machine's file tree where the resources are typically located. For example, configuration files are normally stored in the /etc director on Unix systems. Adversaries can take advantage of this to commit other types of attacks.
CAPEC-639: Probe System Files
An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.