CWE-552
CVEs classified under CWE-552, newest first.
83 CVEsRSS
CVE-2026-67073High· 8.6HCL BigFix AEX is affected by multiple security vulnerabilities.
HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, poten…
CVE-2026-65210Medium· 4.9Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability
This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role.
CVE-2026-46651Critical· 9.8Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-view…
CVE-2026-76531Critical· 9.9Files or Directories Accessible to External Parties in Splunk SOAR
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discov…
CVE-2026-114400Medium· 5.9PoCTrudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-gu…
CVE-2026-112948Medium· 6.5Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
CVE-2026-112144Medium· 5.3PoCsatya-vinay Events-Management-System project.sql file access
A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unknown part of the file project.sql. Executing a manipulation can lead to files or directories access…
CVE-2026-85985Medium· 5.4mariadb: MariaDB: Unauthorized file access via CONNECT engine functions (CVE-2026-85985)
A flaw was found in MariaDB. Certain file-access User-Defined Functions (UDFs) within the CONNECT storage engine do not properly enforce user privileges or directory restrictions when handling file system paths. An authenticated, low-privi…
CVE-2026-102695High· 8.2OmniFaces is a utility library for Faces
OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying th…
CVE-2026-108070High· 8.7A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, byp…
A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, byp…
CVE-2026-96857Medium· 5.5Files or directories accessible to external parties in Windows Projected File System allows an authorized attacker to disclose information locally.
Files or directories accessible to external parties in Windows Projected File System allows an authorized attacker to disclose information locally.
CVE-2026-88137Medium· 6.5Files or directories accessible to external parties in WebDAV allows an authorized attacker to disclose information over a network.
Files or directories accessible to external parties in WebDAV allows an authorized attacker to disclose information over a network.
CVE-2026-85840Medium· 6.5Files or directories accessible to external parties in Windows Event Viewer allows an authorized attacker to disclose information over a network.
Files or directories accessible to external parties in Windows Event Viewer allows an authorized attacker to disclose information over a network.
CVE-2026-85812Medium· 5.5Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally.
Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally.
CVE-2026-109162Medium· 6.3Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination
Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up …
CVE-2026-89118Medium· 5.3SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Av…
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Av…
CVE-2026-108938Medium· 5.3PoCA flaw has been found in code-projects Matrimonial System 1.0
A flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown processing of the file db/matrimony.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The e…
CVE-2026-94375Medium· 5.3The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the get_file_path
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the get_file_path. This makes it possible for unauthenticated attackers …
CVE-2026-106496Low· 3.1Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforcement of allowed location types during catalog processing. Under certain confi…
CVE-2026-105750Medium· 5.9Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend.…
CVE-2026-21589Critical· 9.3CISA KEVPoCThis is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerabili…
GHSA-4wwp-f6gw-6qm5MediumSiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)
SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)
CVE-2026-100727Medium· 5.3An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".
An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".
GHSA-5rmq-chc7-m22fHigh· 7.5Vibe-Trading file-read tools expose arbitrary server-readable files
Vibe-Trading file-read tools expose arbitrary server-readable files
CVE-2026-58415Medium· 5.3Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a G…
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a G…
CVE-2026-71379Critical· 10.0The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.
The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.
CVE-2026-6544Medium· 6.2IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of sensitive or unnecessary files and increased attack surface.
IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of sensitive or unnecessary files and increased attack surface.
CVE-2026-15915Medium· 6.2IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive information due to recursive copying of build context directories into container images.
IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive information due to recursive copying of build context directories into container images.
CVE-2026-77259High· 7.7PoCMCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira)
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment opens a caller-selected server-local file without checking that the resolved path remains …
CVE-2026-88623High· 7.5PoCNUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read
NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen() is used to open the URL in binary read-only mode. The content is then written to…