CWE-552: Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- grafana alloyCVE-2026-75889 CVE Record7.7 High
- No product listedVeno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php...9.1 Critical
- No product listedDocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through...7.5 High
- No product listedOneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link().8.1 High
- alexta69 metubealexta69 MeTube Cookie File cookies.txt file access6.9 Medium
- themeum tutor lmsTutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path6.8 Medium
- apache inlongApache InLong: Missing authorization on DataNode management endpoints8.1 High
- apache inlongApache InLong: Missing authorization in StreamSource forceDelete8.1 High
- jknack handlebars.javaHandlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass7.5 High
- code-projects login registration systemcode-projects Login Registration System SQL Database Backup login_registration_system.sql file access6.9 Medium
- sourcecodester best employee management systemSourceCodester Best Employee Management System Profile exposure of information through directory listing6.9 Medium
- sourcecodester online clothing storeSourceCodester Online Clothing Store SQL Database Backup shopping.sql file access6.9 Medium
- hashicorp toolingVault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath9.6 Critical
- unknown paid membership subscriptionsPaid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files3.7 Low
- sick ag icr890-4, inspectorp61x, inspectorp62x +3 more +5 moreCVE-2026-118419.4 Critical
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Information Disclosure Vulnerability7.4 High
- omnifacesOmniFaces: Forged combined-resource IDs and related output/push boundaries8.2 High
- vitest-dev vitestVitest: Browser Mode provider commands bypass the file-access permission gate9.4 Critical
- makeplane planeCVE-2026-153426.5 Medium
- tensorzeroTensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint7.7 High
- julien040 anyqueryAnyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode7.5 High
- repomixrepomix - Local File Inclusion via file:// URL Scheme in Git Clone Endpoint8.7 High
- agentejo cockpit cms, cockpit cms +1 moreagentejo Cockpit CMS htaccess config.yaml YAMLLoad file access6.9 Medium
- microsoft github copilotGitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user...7.5 High
- aver ptc115, ptc115+, ptc500+ +1 more +3 moreAVer PTC cameras Files or Directories Accessible to External Parties9.3 Critical
- abb t-mac plusFile Disclosure in ABB T-MAC Plus web application and in ABB T-MAC plus Server - Default IIS Web Site7.3 High
- nextcloud forms, kiteworks security-advisories +1 moreNextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share5.3 Medium
- danelec macgregor voyage data recorder (vdr) g4e, macgregor interschalt vdr g4e firmware +1 moreMacGregor Voyage Data Recorder (VDR) G4e Files or Directories Accessible to External Parties6.9 Medium
- ibm qradar, qradar security information and event manager +1 moreIBM QRadar SIEM is vulnerable to using components with known vulnerabilities7.2 High
- synology beedrive, beedrive for desktop +1 moreFiles or directories accessible to external parties vulnerability in redis-server component in...6.8 Medium
- apache flink kubernetes operatorApache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator6.5 Medium
- xyproto algernonAlgernon: handler.lua discovery walks parent directories above the server root9.0 Critical
- timlegge crypt::dsaCrypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified6.5 Medium
ha-mcpPyPIHome Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/6.5 Medium- grafana, grafana oss +1 moreSQL Expressions Read File From Disk6.3 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 moreiControl SOAP vulnerability6.9 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +19 more +21 moreBIG-IP iControl SOAP vulnerability8.5 High
- microsoft teams, teams for android +1 moreMicrosoft Teams Spoofing Vulnerability5.5 Medium
- microsoft office, word, 365 apps +6 more +8 moreMicrosoft Word Information Disclosure Vulnerability5.5 Medium
- hahwul dalfoxDalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server Mode7.5 High
- nexentThe nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion...9.1 Critical
- nexentThe nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion...9.1 Critical
- apple macosA path handling issue was addressed with improved logic. This issue is fixed in macOS Sequoia 15...7.5 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpoints7.1 High
@axonflow/openclawnpm@axonflow/openclaw fix introduces plugin cache and credential-file permission hardening5.5 Medium- papercut ng/mf, mf, ng +2 morePaperCut NG/MF: Path Traversal in Shared Account Synchronization4.6 Medium
- unknown magic export & importMagic Export & Import < 1.2.0 - Unauthenticated PII Disclosure5.3 Medium
- No product listedAn issue in Pro-Bit before v1.77.4 allows unauthenticated attackers to directly access sensitive directory and its subdirectories.7.5 High
- churchcrm crmChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function9.1 Critical
- progress software corporation openedgeUnauthorized Arbitrary File Read via RMI in AdminServer Interface8.2 High
- Show moreLoading…