Weaknesses of type CWE-552

365 results

Arquivos ou diretórios acessíveis a terceiros

Ocorre quando arquivos ou diretórios sensíveis ficam expostos com permissões inadequadas, permitindo que usuários não autorizados (locais ou remotos) leiam, modifiquem ou executem conteúdo confidencial. É um erro de configuração de controle de acesso que compromete a confidencialidade e integridade dos dados.

Example

Um servidor web que salva chaves privadas de API ou credenciais de banco de dados em um diretório público (/var/www/html), ou um arquivo de configuração com modo 644 contendo senhas que qualquer usuário do sistema consegue ler. Um atacante consegue recuperar essas informações sensíveis sem autenticação.

How to mitigate

Aplique o princípio do menor privilégio: defina permissões de arquivo (chmod) e ACLs restritivas (apenas quem precisa acessa), armazene dados sensíveis fora da raiz pública do servidor web, use variáveis de ambiente ou cofres de secrets para credenciais, e audite regularmente permissões e propriedade de arquivos críticos.

CVE-2026-54629HIGHAnyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server ModeEPSS 1.0%CVE-2022-2981—Download Monitor < 4.5.98 - Admin+ Arbitrary File DownloadEPSS 1.0%CVE-2024-40767MEDIUMIn OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 imEPSS 0.9%CVE-2023-49198HIGHApache SeaTunnel Web: Arbitrary file read vulnerabilityEPSS 0.9%CVE-2024-2055CRITICALArtica Proxy Unauthenticated File Manager VulnerabilityEPSS 0.9%CVE-2024-1005MEDIUMShanxi Diankeyun Technology NODERP log file accessEPSS 0.9%CVE-2019-3897—It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know itEPSS 0.9%CVE-2025-0509HIGHSigning Checks BypassEPSS 0.9%CVE-2023-29931—laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php.EPSS 0.9%CVE-2026-2331CRITICALCVE-2026-2331EPSS 0.9%CVE-2022-24075—Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP fiEPSS 0.9%CVE-2021-34765MEDIUMCisco Nexus Insights Authenticated Information Disclosure VulnerabilityEPSS 0.9%CVE-2022-42234HIGHThere is a file inclusion vulnerability in the template management module in UCMS 1.6EPSS 0.9%CVE-2026-40484CRITICALChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore FunctionEPSS 0.9%CVE-2022-31475MEDIUMWordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Read via Export function vulnerabilityEPSS 0.9%CVE-2023-25260HIGHStimulsoft Designer (Web) 2023.1.3 is vulnerable to Local File Inclusion.EPSS 0.8%CVE-2024-32498MEDIUMAn issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur viEPSS 0.8%CVE-2026-40624CRITICALAVer PTC cameras Files or Directories Accessible to External PartiesEPSS 0.8%CVE-2024-51058MEDIUMLocal File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read arbitrary files from EPSS 0.8%CVE-2021-33843MEDIUMFresenius Kabi Agilia Connect Infusion System files or directories accessible to external partiesEPSS 0.8%