About CWE-552
MITRE lists these common consequences: Read Files or Directories, Modify Files or Directories, affecting confidentiality, integrity.
- MITRE name
- Files or Directories Accessible to External Parties
- Abstraction
- Base: abstract, but detailed enough to infer detection and prevention methods
- Status
- Draft
Mitigations
- When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
Detection
MITRE lists these detection methods: Automated Static Analysis (high).
CWE-552 in the KEV Catalog
as of 2026-11-12- 5 CISA KEV entries name Files or Directories Accessible to External Parties (CWE-552) in their CVE record, tied for 49th among the 194 weaknesses named in the catalog.
- CISA added 1 CWE-552 entry to the KEV catalog in 2024, 1 in 2025, and 1 so far in 2026.
Related Attack Patterns
2 CAPEC patternsCAPEC-150Collect Data from Common Resource LocationsStandard · Severity Medium
Loading…
CAPEC-639Probe System FilesDetailed · Severity Medium
Loading…
CWE-552 Vulnerabilities
6 CVEs| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2026-21589KEV Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | Atlassian | 9.3 | 99.7% | KEV | 2026-10-05 |
| CVE-2025-11371KEV Gladinet CentreStack and TrioFox Local File Inclusion Flaw | Gladinet CentreStack and TrioFox Local File Inclusion Flaw | Gladinet | 7.5 | 92.1% | KEV | 2025-10-09 |
| CVE-2020-17519KEV Apache Flink directory traversal attack: reading remote files through the REST API | Apache Flink directory traversal attack: reading remote files through the REST API | Apache Software Foundation | 9.1 | 98.0% | KEV | 2021-01-05 |
| CVE-2016-3715KEV ImageMagick Arbitrary File Deletion Vulnerability | ImageMagick Arbitrary File Deletion Vulnerability | - | 5.5 | 75.3% | KEV | 2016-05-05 |
| CVE-2017-16651KEV Roundcube Webmail File Disclosure Vulnerability | Roundcube Webmail File Disclosure Vulnerability | - | 7.8 | 45.7% | KEV | 2017-11-09 |
| CVE-2026-25137 NixOs Odoo database and filestore publicly accessible with default odoo configuration | NixOs Odoo database and filestore publicly accessible with default odoo configuration | NixOS | 9.1 | 10.3% | 2026-02-02 |
Frequently Asked Questions
What is CWE-552?→
CWE-552 (Files or Directories Accessible to External Parties) is a MITRE CWE entry. The product makes files or directories accessible to unauthorized actors, even though they should not be.
How many exploited vulnerabilities are classified as CWE-552?→
This database lists 6 CVE records mapped to CWE-552 by their CVE Numbering Authority. 5 of them are in the CISA Known Exploited Vulnerabilities catalog. Examples include CVE-2026-21589, CVE-2025-11371, CVE-2020-17519.
Weakness description, consequences, and mitigations from the CWE List, © The MITRE Corporation, used under the CWE Terms of Use. CWE mappings come from each CVE record's CNA. Exploited-in-the-wild data from the CISA KEV catalog (CC0). This site is not affiliated with or endorsed by MITRE or CISA. Attack patterns from CAPEC 3.9, © The MITRE Corporation, used under the CAPEC Terms of Use.