CWE-552 Files or Directories Accessible to External Parties

Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)

Vibe-Trading file-read tools expose arbitrary server-readable files

MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass

@vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Unauthorized File Access in node-git-server

TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint

Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode

Picklescan vulnerable to Arbitrary File Writing

Grafana: SQL Expressions Read File From Disk

Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file`

Exposure of .env if project root is configured as web root in shopware/production

Algernon: handler.lua discovery walks parent directories above the server root

pgAdmin 4 contains local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities

Home Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/

@axonflow/openclaw fix introduces plugin cache and credential-file permission hardening

OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration

FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft

SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes

TinaCMS CLI has Arbitrary File Read via Disabled Vite Filesystem Restriction

Liferay Portal Unauthenticated File Access via URL

Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality

Constellation has insecure LUKS2 persistent storage partitions which may be opened and used

Contrast has insecure LUKS2 persistent storage partitions may be opened and used