Weaknesses of type CWE-552

365 results

Arquivos ou diretórios acessíveis a terceiros

Ocorre quando arquivos ou diretórios sensíveis ficam expostos com permissões inadequadas, permitindo que usuários não autorizados (locais ou remotos) leiam, modifiquem ou executem conteúdo confidencial. É um erro de configuração de controle de acesso que compromete a confidencialidade e integridade dos dados.

Example

Um servidor web que salva chaves privadas de API ou credenciais de banco de dados em um diretório público (/var/www/html), ou um arquivo de configuração com modo 644 contendo senhas que qualquer usuário do sistema consegue ler. Um atacante consegue recuperar essas informações sensíveis sem autenticação.

How to mitigate

Aplique o princípio do menor privilégio: defina permissões de arquivo (chmod) e ACLs restritivas (apenas quem precisa acessa), armazene dados sensíveis fora da raiz pública do servidor web, use variáveis de ambiente ou cofres de secrets para credenciais, e audite regularmente permissões e propriedade de arquivos críticos.

CVE-2026-53580HIGHTrilium arbitrary file read and denial of service via file:// URLs in the automatic image-download featureEPSS 0.3%CVE-2025-66955MEDIUMLocal File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access fileEPSS 0.3%CVE-2026-5335MEDIUMMagic Export & Import < 1.2.0 - Unauthenticated PII DisclosureEPSS 0.3%CVE-2020-3476MEDIUMCisco IOS XE Software Arbitrary File Overwrite VulnerabilityEPSS 0.3%CVE-2026-45543MEDIUMNextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files shareEPSS 0.3%CVE-2023-32684LOWIn Lima, a malicious disk image could read a single file on the host filesystem as a qcow2/vmdk backing fileEPSS 0.3%CVE-2021-42744MEDIUMPhilips MRI 1.5T and 3T Information ExposureEPSS 0.3%CVE-2018-25164HIGHEverSync 0.5 Arbitrary File Download via files DirectoryEPSS 0.3%CVE-2026-24732MEDIUMImproper permission checks in Extension:NSFileRepoEPSS 0.3%CVE-2023-45594MEDIUMA CWE-552 “Files or Directories Accessible to External Parties” vulnerability in the embedded Chromium browser allows a physical attacker toEPSS 0.3%CVE-2025-43749MEDIUMLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.EPSS 0.3%CVE-2025-51818MEDIUMMCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an attacker to execute arbitrary commandsEPSS 0.3%CVE-2026-75464HIGHOneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link().EPSS 0.3%CVE-2025-12894MEDIUMImport WP – Export and Import CSV and XML files to WordPress <= 2.14.17 - Unauthenticated Information ExposureEPSS 0.3%CVE-2024-29225MEDIUMELECOM wireless LAN routers allow a network-adjacent unauthenticated attacker to obtain the configuration file containing sensitive informatEPSS 0.3%CVE-2026-73736MEDIUMUnauthenticated Limited Information Disclosure leads to Data Exposure in HPE Networking Fabric ComposerEPSS 0.3%CVE-2026-45088HIGHDalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server ModeEPSS 0.3%CVE-2026-34392HIGHLORIS has a path traversal in static routerEPSS 0.3%CVE-2026-40631HIGHBIG-IP iControl SOAP vulnerabilityEPSS 0.2%CVE-2023-2976MEDIUMUse of temporary directory for file creation in `FileBackedOutputStream` in GuavaEPSS 0.2%