Skip to content
Noroxi

CWE-552 · 430 records

Files or Directories Accessible to External Parties

CVEs in this class

430 records

  • CVE-2020-17519
    89Now

    Apache Flink directory traversal attack: reading remote files through the REST API

    HighCVSS 7.5KEVWeaponizedEPSS 98%

    apache · flinkJan 5, 2021

  • CVE-2025-11371
    88Now

    Gladinet CentreStack and TrioFox Local File Inclusion Flaw

    HighCVSS 7.5KEVWeaponizedEPSS 92%

    gladinet · centrestackOct 9, 2025

  • CVE-2016-3715
    75This week

    The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted im

    MediumCVSS 5.5KEVWeaponizedEPSS 75%

    imagemagick · imagemagickMay 5, 2016

  • CVE-2017-16651
    75This week

    Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's file

    HighCVSS 7.8KEVWeaponizedEPSS 46%

    roundcube · webmailNov 9, 2017

  • CVE-2023-50164
    63This week

    Apache Struts: File upload component had a directory traversal vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 81%

    apache · strutsDec 7, 2023

  • CVE-2020-15175
    57Plan

    Unauthenticated File Deletion in GLPI

    CriticalCVSS 9.1Proof of conceptEPSS 72%

    glpi-project · glpiOct 7, 2020

  • CVE-2017-14942
    57Plan

    Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct reques

    CriticalCVSS 9.8Proof of conceptEPSS 61%

    intelbras · wrn 150 firmwareSep 29, 2017

  • CVE-2024-53676
    56Plan

    A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.

    CriticalCVSS 9.8No exploitEPSS 56%

    hpe · insight remote supportNov 26, 2024

  • CVE-2024-39931
    55Plan

    Gogs through 0.13.0 allows deletion of internal files.

    CriticalCVSS 9.9No exploitEPSS 53%

    gogs · gogsJul 4, 2024

  • CVE-2023-2766
    46Plan

    Weaver OA jx2_config.ini file access

    HighCVSS 7.5Proof of conceptEPSS 54%

    weaver · e-officeMay 17, 2023

  • CVE-2024-6209
    42Plan

    unauthorized file access

    CriticalCVSS 9.4Proof of conceptEPSS 17%

    abb · aspect-ent-12 firmwareJul 5, 2024

  • CVE-2025-41240
    40Plan

    Mounted Kubernetes Secrets under a predictable path located within the web server document root

    CriticalCVSS 10.0No exploitEPSS 1%

    vmware · bitnamicharts/appsmithJul 24, 2025

  • CVE-2026-71379
    40Plan

    Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties

    CriticalCVSS 10.0No exploitEPSS 0%

    toptech systems · tms7Sep 29, 2026

  • CVE-2023-6114
    39Monitor

    Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure

    HighCVSS 7.5Proof of conceptEPSS 31%

    awesomemotive · duplicatorDec 26, 2023

  • CVE-2015-5211
    39Monitor

    Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to

    CriticalCVSS 9.6No exploitEPSS 3%

    vmware · spring frameworkMay 25, 2017

  • CVE-2020-12743
    39Monitor

    An issue was discovered in Gazie 7.32.

    CriticalCVSS 9.8No exploitEPSS 2%

    gazie project · gazieMay 11, 2020

  • CVE-2024-56731
    39Monitor

    Gogs deletion of internal files allows remote command execution

    CriticalCVSS 9.8No exploitEPSS 1%

    gogs · gogsJun 24, 2025

  • CVE-2017-10930
    39Monitor

    The ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized actor, resulting in ordinary users being a

    CriticalCVSS 9.8No exploitEPSS 1%

    zte · zxr10 1800-2s firmwareSep 19, 2017

  • CVE-2026-2331
    39Monitor

    An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due t

    CriticalCVSS 9.8No exploitEPSS 1%

    sick ag · sick lector85xMar 6, 2026

  • CVE-2023-29931
    39Monitor

    laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    laravels project · laravelsJun 22, 2023

  • CVE-2023-48710
    39Monitor

    iTop limit pages/exec.php script to PHP files

    CriticalCVSS 9.8No exploitEPSS 1%

    combodo · itopApr 15, 2024

  • CVE-2024-39581
    39Monitor

    Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a File or Directories Accessible to External Parties vulnerability.

    CriticalCVSS 9.8No exploitEPSS 0%

    dell · insightiqSep 10, 2024

  • CVE-2026-21589
    38Monitor

    This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Ba

    CriticalCVSS 9.3Proof of conceptEPSS 3%

    atlassian · bamboo data centerOct 5, 2026

  • CVE-2025-11919
    38Monitor

    Unprotected temporary directories in Wolfram Cloud may result in privilege escalation

    CriticalCVSS 9.6No exploitEPSS 0%

    wolfram research inc. · cloudJun 26, 2026

  • CVE-2026-8715
    38Monitor

    Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath

    CriticalCVSS 9.6No exploitEPSS 0%

    hashicorp · toolingAug 13, 2026

All vulnerability classes