CWE-552
AllowedFiles or Directories Accessible to External Parties
Abstraction: Base · Status: Draft
The product makes files or directories accessible to unauthorized actors, even though they should not be.
750 vulnerabilities reference this CWE, most recent first.
GHSA-GF6V-V2M7-4PR4
Vulnerability from github – Published: 2025-02-14 00:30 – Updated: 2025-02-14 00:30An attacker could obtain firmware files and reverse engineer their intended use leading to loss of confidentiality and integrity of the hardware devices enabled by the Qardio iOS and Android applications.
{
"affected": [],
"aliases": [
"CVE-2025-23421"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-13T22:15:12Z",
"severity": "MODERATE"
},
"details": "An attacker could obtain firmware files and reverse engineer their \nintended use leading to loss of confidentiality and integrity of the \nhardware devices enabled by the Qardio iOS and Android applications.",
"id": "GHSA-gf6v-v2m7-4pr4",
"modified": "2025-02-14T00:30:44Z",
"published": "2025-02-14T00:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23421"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-044-01"
},
{
"type": "WEB",
"url": "https://www.qardio.com/about-us/#contact"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GG9W-4VV2-VJCM
Vulnerability from github – Published: 2026-09-03 15:32 – Updated: 2026-09-03 15:32SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan's CA (ca.key).
{
"affected": [],
"aliases": [
"CVE-2026-85175"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-03T13:06:25Z",
"severity": "HIGH"
},
"details": "SiYuan versions \u003c= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan\u0027s CA (ca.key).",
"id": "GHSA-gg9w-4vv2-vjcm",
"modified": "2026-09-03T15:32:21Z",
"published": "2026-09-03T15:32:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4wwp-f6gw-6qm5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85175"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/siyuan-before-3.8.2-tls-private-key-disclosure-via-getfile"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GGP3-C9PX-5C4P
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-08-11 00:00If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected data. This could have resulted in Thunderbird showing incorrect information, for example the attacker could have tricked Thunderbird to show folders that didn't exist on the IMAP server. This vulnerability affects Thunderbird < 78.12.
{
"affected": [],
"aliases": [
"CVE-2021-29969"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-05T20:15:00Z",
"severity": "MODERATE"
},
"details": "If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn\u0027t ignore the injected data. This could have resulted in Thunderbird showing incorrect information, for example the attacker could have tricked Thunderbird to show folders that didn\u0027t exist on the IMAP server. This vulnerability affects Thunderbird \u003c 78.12.",
"id": "GHSA-ggp3-c9px-5c4p",
"modified": "2022-08-11T00:00:29Z",
"published": "2022-05-24T19:10:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29969"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1682370"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202208-14"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2021-30"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GGQW-H359-HVRR
Vulnerability from github – Published: 2025-08-21 15:30 – Updated: 2025-08-21 18:31MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an attacker to execute arbitrary commands
{
"affected": [],
"aliases": [
"CVE-2025-51818"
],
"database_specific": {
"cwe_ids": [
"CWE-552",
"CWE-77"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-21T14:15:40Z",
"severity": "MODERATE"
},
"details": "MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an attacker to execute arbitrary commands",
"id": "GHSA-ggqw-h359-hvrr",
"modified": "2025-08-21T18:31:26Z",
"published": "2025-08-21T15:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51818"
},
{
"type": "WEB",
"url": "https://github.com/Y4y17/CVE/blob/main/Arbitrary%20file%20deletion%20vulnerability.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GH53-MCRP-WP5M
Vulnerability from github – Published: 2022-05-24 17:31 – Updated: 2022-05-24 17:31Dell EMC NetWorker versions prior to 19.3.0.2 contain an improper authorization vulnerability. Certain remote users with low privileges may exploit this vulnerability to perform 'nsrmmdbd' operations in an unintended manner.
{
"affected": [],
"aliases": [
"CVE-2020-26183"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-16T18:15:00Z",
"severity": "MODERATE"
},
"details": "Dell EMC NetWorker versions prior to 19.3.0.2 contain an improper authorization vulnerability. Certain remote users with low privileges may exploit this vulnerability to perform \u0027nsrmmdbd\u0027 operations in an unintended manner.",
"id": "GHSA-gh53-mcrp-wp5m",
"modified": "2022-05-24T17:31:03Z",
"published": "2022-05-24T17:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26183"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/security/en-us/details/546616/DSA-2020-229-Dell-EMC-NetWorker-Multiple-Security-Vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GPCV-CXPV-WV29
Vulnerability from github – Published: 2022-03-29 00:01 – Updated: 2022-04-01 00:0074cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php.
{
"affected": [],
"aliases": [
"CVE-2022-26271"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-28T01:15:00Z",
"severity": "HIGH"
},
"details": "74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \\index\\controller\\Download.php.",
"id": "GHSA-gpcv-cxpv-wv29",
"modified": "2022-04-01T00:00:48Z",
"published": "2022-03-29T00:01:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26271"
},
{
"type": "WEB",
"url": "https://github.com/N1ce759/74cmsSE-Arbitrary-File-Reading/issues/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GQF3-X727-H474
Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2022-05-24 17:32Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp application even after the phone was locked.
{
"affected": [],
"aliases": [
"CVE-2020-1908"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-03T20:15:00Z",
"severity": "MODERATE"
},
"details": "Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp application even after the phone was locked.",
"id": "GHSA-gqf3-x727-h474",
"modified": "2022-05-24T17:32:58Z",
"published": "2022-05-24T17:32:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1908"
},
{
"type": "WEB",
"url": "https://www.whatsapp.com/security/advisories/2020"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GQMF-JQGV-V8FW
Vulnerability from github – Published: 2024-05-03 20:28 – Updated: 2024-05-03 20:28Impact
If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to.
Workarounds
Enabling the ignore_panel_config_updates option or updating to the latest version of Wings are the only known workarounds.
Patches
https://github.com/pterodactyl/wings/commit/5415f8ae07f533623bd8169836dd7e0b933964de
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/pterodactyl/wings"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.11.12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-34066"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-03T20:28:10Z",
"nvd_published_at": "2024-05-03T18:15:09Z",
"severity": "HIGH"
},
"details": "### Impact\n\nIf the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to.\n\n### Workarounds\n\nEnabling the `ignore_panel_config_updates` option or updating to the latest version of Wings are the only known workarounds.\n\n### Patches\n\nhttps://github.com/pterodactyl/wings/commit/5415f8ae07f533623bd8169836dd7e0b933964de",
"id": "GHSA-gqmf-jqgv-v8fw",
"modified": "2024-05-03T20:28:10Z",
"published": "2024-05-03T20:28:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pterodactyl/wings/security/advisories/GHSA-gqmf-jqgv-v8fw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34066"
},
{
"type": "WEB",
"url": "https://github.com/pterodactyl/wings/commit/5415f8ae07f533623bd8169836dd7e0b933964de"
},
{
"type": "PACKAGE",
"url": "https://github.com/pterodactyl/wings"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Pterodactyl Wings vulnerable to Arbitrary File Write/Read"
}
GHSA-GR66-X5PQ-8G2G
Vulnerability from github – Published: 2026-10-06 00:32 – Updated: 2026-10-19 21:35h3. Summary
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe.
h3. Context
This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions.
h3. Details:
- The vulnerability must be addressed for affected versions of: Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.1, 7.2.4 Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 Crucible, fix versions 4.9.15 Fisheye, fix version 4.9.15
- Exploitation requires prior knowledge of the target file's exact name and path.
- The vulnerability does not include the capability to enumerate or list directory contents.
{
"affected": [],
"aliases": [
"CVE-2026-21589"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-05T22:16:58Z",
"severity": "CRITICAL"
},
"details": "h3. Summary\n\nThis is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file\u0027s exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents.\u00a0In some configurations, there may be some sensitive files that make this highly severe.\u00a0\u00a0\n\nh3. Context\n\nThis vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions.\n\nh3. Details:\n\n* The vulnerability must be addressed for affected versions of:\n Bitbucket Data Center, introduced in version \u003e= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1\n Confluence Data Center, introduced in version \u003e= 5.10.0, fix versions 9.2.26, 10.2.19\n Crowd Data Center, introduced in version \u003e= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.1, 7.2.4\n Jira Software Data Center, introduced in version \u003e= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12\n Jira Service Management Data Center, introduced in version \u003e= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12\n Bamboo Data Center \u003e= 7.0.1, fix versions 10.2.24, 12.1.12\n Crucible, fix versions 4.9.15\n Fisheye, fix version 4.9.15\n* Exploitation requires prior knowledge of the target file\u0027s exact name and path.\n* The vulnerability does not include the capability to enumerate or list directory contents.",
"id": "GHSA-gr66-x5pq-8g2g",
"modified": "2026-10-19T21:35:53Z",
"published": "2026-10-06T00:32:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21589"
},
{
"type": "WEB",
"url": "https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/BAM-26567"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/BSERV-20604"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/CONFSERVER-104488"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/CRUC-8741"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/CWD-6610"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/FE-7583"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/JRASERVER-79546"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/JSDSERVER-16809"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GX86-89J2-8XM8
Vulnerability from github – Published: 2024-12-12 12:31 – Updated: 2024-12-12 12:31File replacement vulnerability on some devices Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.
{
"affected": [],
"aliases": [
"CVE-2024-54099"
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-12T12:15:23Z",
"severity": "MODERATE"
},
"details": "File replacement vulnerability on some devices\nImpact: Successful exploitation of this vulnerability will affect integrity and confidentiality.",
"id": "GHSA-gx86-89j2-8xm8",
"modified": "2024-12-12T12:31:15Z",
"published": "2024-12-12T12:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54099"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2024/12"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
CAPEC-150: Collect Data from Common Resource Locations
An adversary exploits well-known locations for resources for the purposes of undermining the security of the target. In many, if not most systems, files and resources are organized in a default tree structure. This can be useful for adversaries because they often know where to look for resources or files that are necessary for attacks. Even when the precise location of a targeted resource may not be known, naming conventions may indicate a small area of the target machine's file tree where the resources are typically located. For example, configuration files are normally stored in the /etc director on Unix systems. Adversaries can take advantage of this to commit other types of attacks.
CAPEC-639: Probe System Files
An adversary obtains unauthorized information due to improperly protected files. If an application stores sensitive information in a file that is not protected by proper access control, then an adversary can access the file and search for sensitive information.