CWE-552— Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.— MITRE CWE catalog

573 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-552page 10 of 12

CVE-2026-123988MEDIUMCVSS 5.3EG 5.3
2026-11-07
A vulnerability has been found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. This issue affects some unknown processing of the file /Food-Ordering-System/admin/. Such manipulation leads to exposur…
CVE-2026-123197MEDIUMCVSS 5.3EG 5.3
2026-11-05
WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount. Attackers can enumerate Unix timestamps in GET /files/…
CVE-2026-120501MEDIUMCVSS 5.3EG 5.3
2026-11-02
An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. …
CVE-2026-112144MEDIUMCVSS 5.3EG 5.3
2026-10-19
A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unknown part of the file project.sql. Executing a manipulation can lead to files or directories accessib…
CVE-2026-89118MEDIUMCVSS 5.3EG 5.3
2026-10-13
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Avai…
CVE-2026-108938MEDIUMCVSS 5.3EG 5.3
2026-10-12
A flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown processing of the file db/matrimony.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exp…
CVE-2026-94375MEDIUMCVSS 5.3EG 5.3
2026-10-10
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the get_file_path. This makes it possible for unauthenticated attackers to…
CVE-2026-100727MEDIUMCVSS 5.3EG 5.3
2026-10-05
An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".
CVE-2026-58415MEDIUMCVSS 5.3EG 5.3
2026-10-01
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET…
CVE-2026-73736MEDIUMCVSS 5.3EG 5.3
2026-09-01
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files. Successful exploitation could allow an attacker to read files within the affe…
CVE-2026-78051MEDIUMCVSS 5.3EG 5.3
2026-08-22
A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the file /download/.metube/cookies.txt of the component Cookie File Handler. This manipulation causes files or directories a…
CVE-2026-76799MEDIUMCVSS 5.3EG 5.3
2026-08-20
A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the file /loginsystem/database/login_registration_system.sql of the component SQL Database Backup Handler. This manipulation…
CVE-2026-19987MEDIUMCVSS 5.3EG 5.3
2026-08-17
A security vulnerability has been detected in SourceCodester Best Employee Management System 1.0. This affects an unknown function of the file /assets/uploadImage/Profile/. Such manipulation leads to exposure of information through directo…
CVE-2026-19903MEDIUMCVSS 5.3EG 5.3
2026-08-15
A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to files or directories accessible. Remote e…
CVE-2026-13533MEDIUMCVSS 5.3EG 5.3
2026-06-29
A security vulnerability has been detected in agentejo Cockpit CMS up to 0.12.2. Affected by this issue is the function Spyc::YAMLLoad of the file /config/config.yaml of the component htaccess Handler. Such manipulation leads to files or d…
CVE-2026-45543MEDIUMCVSS 5.3EG 5.3
2026-06-01
Nextcloud is an open source content collaboration platform. From version 4.3.0 to before version 5.2.7, a removed collaborator retains unauthorized read access to uploaded respondent files for the affected form. The scope is limited to upl…
CVE-2026-5335MEDIUMCVSS 5.3EG 5.3
2026-05-04
The Magic Export & Import WordPress plugin before 1.2.0 stores exported CSV files at a publicly accessible location, making it possible for any visitors to leak sensitive user information.
CVE-2026-4900MEDIUMCVSS 5.3EG 5.3
2026-03-26
A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file /dbfood/localhost.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely…
CVE-2025-12648MEDIUMCVSS 5.3EG 5.3
2026-01-07
The WP-Members Membership Plugin for WordPress is vulnerable to unauthorized file access in versions up to, and including, 3.5.4.4. This is due to storing user-uploaded files in predictable directories (wp-content/uploads/wpmembers/user_fi…
CVE-2025-14442MEDIUMCVSS 5.3EG 5.3
2025-12-12
The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV files in a publicly accessible directory with predictable filenames in all versions …
CVE-2025-12747MEDIUMCVSS 5.3EG 5.3
2025-11-21
The Tainacan plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via uploaded files marked as private being exposed in wp-content without adequate protection. This makes it possible for u…
CVE-2025-12894MEDIUMCVSS 5.3EG 5.3
2025-11-21
The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.17 via the import/export functionality and a lack of .htacce…
CVE-2025-13200MEDIUMCVSS 5.3EG 5.3
2025-11-15
A vulnerability was determined in SourceCodester Farm Management System 1.0. Affected by this vulnerability is an unknown functionality. This manipulation causes exposure of information through directory listing. The attack is possible to …
CVE-2025-33150MEDIUMCVSS 5.3EG 5.3
2025-11-10
IBM Cognos Analytics Certified Containers 12.1.0 could disclose package parameter information due to the presence of hidden pages.
CVE-2025-58152MEDIUMCVSS 5.3EG 5.3
2025-10-31
FutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and the garbage collection information on the internal web page. With some crafted HTTP request, they can be accessed without authentication.
CVE-2025-52460MEDIUMCVSS 5.3EG 5.3
2025-08-28
Files or directories accessible to external parties issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If exploited, uploaded files and SS1 configuration files may be accessed by a remote unauthenticated att…
CVE-2025-43758MEDIUMCVSS 5.3EG 5.3
2025-08-22
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows …
CVE-2025-43749MEDIUMCVSS 5.3EG 5.3
2025-08-20
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows …
CVE-2025-4807MEDIUMCVSS 5.3EG 5.3
2025-05-16
A vulnerability, which was classified as problematic, was found in SourceCodester Online Student Clearance System 1.0. This affects an unknown part. The manipulation leads to exposure of information through directory listing. It is possibl…
CVE-2025-2652MEDIUMCVSS 5.3EG 5.3
2025-03-23
A vulnerability has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to exposure of information…
CVE-2025-2651MEDIUMCVSS 5.3EG 5.3
2025-03-23
A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /oews/admin/. The manipulation leads to exposure of information through directory listin…
CVE-2025-2147MEDIUMCVSS 5.3EG 5.3
2025-03-10
A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to files or dir…
CVE-2024-47106MEDIUMCVSS 5.3EG 5.3
2025-01-18
IBM Jazz for Service Management 1.1.3 through 1.1.3.22 could allow a remote attacker to obtain sensitive information from improper access restrictions that could aid in further attacks against the system.
CVE-2024-9945MEDIUMCVSS 5.3EG 5.3
2024-12-13
An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in certain admin root folders.
CVE-2024-49756MEDIUMCVSS 5.3EG 5.3
2024-10-23
AshPostgres is the PostgreSQL data layer for Ash Framework. Starting in version 2.0.0 and prior to version 2.4.10, in certain very specific situations, it was possible for the policies of an update action to be skipped. This occurred only …
CVE-2024-44807MEDIUMCVSS 5.3EG 5.3
2024-10-11
A directory listing issue in the baserCMS plugin in D-ZERO CO., LTD. BurgerEditor and BurgerEditor Limited Edition before 2.25.1 allows remote attackers to obtain sensitive information by exposing a list of the uploaded files.
CVE-2024-8655MEDIUMCVSS 5.3EG 5.3
2024-09-10
A vulnerability was found in Mercury MNVR816 up to 2.0.1.0.5. It has been classified as problematic. This affects an unknown part of the file /web-static/. The manipulation leads to files or directories accessible. It is possible to initia…
CVE-2024-5587MEDIUMCVSS 5.3EG 5.3
2024-06-02
A vulnerability was found in Casdoor up to 1.335.0. It has been classified as problematic. Affected is an unknown function of the file /conf/app.conf of the component Configuration File Handler. The manipulation leads to files or directori…
CVE-2024-5045MEDIUMCVSS 5.3EG 5.3
2024-05-17
A vulnerability was found in SourceCodester Online Birth Certificate Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin. The manipulation leads to files or directories acc…
CVE-2024-1005MEDIUMCVSS 5.3EG 5.3
2024-01-29
A vulnerability has been found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This vulnerability affects unknown code of the file /runtime/log. The manipulation leads to files or directories accessible. The a…
CVE-2023-52112MEDIUMCVSS 5.3EG 5.3
2024-01-16
Unauthorized file access vulnerability in the wallpaper service module. Successful exploitation of this vulnerability may cause features to perform abnormally.
CVE-2023-4933MEDIUMCVSS 5.3EG 5.3
2023-10-16
The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job applications, allowing unauthenticated visitors to list and download private attachments if the aut…
CVE-2023-5101MEDIUMCVSS 5.3EG 5.3
2023-10-09
Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged remote attacker to download various files from the server via HTTP requests.
CVE-2023-34834MEDIUMCVSS 5.3EG 5.3
2023-06-29
A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attackers to gain sensitive information about the configured databases via the "/file" endpoint.
CVE-2023-29107MEDIUMCVSS 5.3EG 5.3
2023-05-09
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The export endpoint discloses some undocumented files. This could allow an una…
CVE-2023-22858MEDIUMCVSS 5.3EG 5.3
2023-03-06
An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs.
CVE-2022-4346MEDIUMCVSS 5.3EG 5.3
2023-01-23
The All-In-One Security (AIOS) WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address.
CVE-2022-43414MEDIUMCVSS 5.3EG 5.3
2022-10-19
Jenkins NUnit Plugin 0.27 and earlier implements an agent-to-controller message that parses files inside a user-specified directory as test results, allowing attackers able to control agent processes to obtain test results from files in an…
CVE-2022-2834MEDIUMCVSS 5.3EG 5.3
2022-10-17
The Helpful WordPress plugin before 4.5.26 puts the exported logs and feedbacks in a publicly accessible location and guessable names, which could allow attackers to download them and retrieve sensitive information such as IP, Names and Em…
CVE-2022-34049MEDIUMCVSS 5.3EG 5.3
2022-07-20
An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows unauthenticated attackers to download log files and configuration data.

Map vulnerabilities like CWE-552 to your infrastructure

EchelonGraph correlates every CVE — across CWE-552 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →