CWE-538Insertion of Sensitive Information into Externally-Accessible File or Directory

Abstraction: Base · CVEs in our corpus: 96

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Last updated: 21 August 2026 22:22 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 3 mapping(s) from 3 framework(s): CAPEC 1 (partial) · STIG oracle linux 8 1 (partial) · STIG rhel 8 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

RA-2 Security Categorization
RA-8 Privacy Impact Assessments
AC-22 Publicly Accessible Content
AU-13 Monitoring for Information Disclosure

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

2 hardening rules · 2 OS baselines

Validate

Prove the fix (OWASP ASVS)

V14.1.2
V14.2.8

NIST 800-53 r5 controls that address this weakness (8)AI-assisted

Control	Title	Family	Why it addresses this CWE
`RA-2`	Security Categorization	RA	Approved categorization forces identification of externally accessible files that contain sensitive content so they receive proper protection.
`RA-8`	Privacy Impact Assessments	RA	The pre-implementation review identifies externally accessible files or directories containing PII and drives access restrictions or removal.
`AC-22`	Publicly Accessible Content	AC	Pre- and post-publication reviews prevent insertion of sensitive information into externally-accessible public locations.
`AU-13`	Monitoring for Information Disclosure	AU	Monitors for sensitive information placed in externally accessible files or directories.
`CM-13`	Data Action Mapping	CM	The map shows if data actions result in sensitive information being placed in externally accessible locations.
`IR-9`	Information Spillage Response	IR	Isolation and eradication reduce the ability to exploit sensitive information inserted into externally-accessible files or directories.
`SI-20`	Tainting	SI	Tainting makes it possible to determine when sensitive data has been removed from externally accessible files or directories.
`SR-7`	Supply Chain Operations Security	SR	OPSEC practices stop placement of supply-chain information into locations accessible to external parties.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2019-6851`	7.4	7.5	0.2989	2019-10-29
`CVE-2016-20024`	7.4	9.8	0.0073	2026-03-16
`CVE-2023-28444`	7.2	9.9	0.0076	2023-03-24
`CVE-2025-12059`	7.2	9.8	0.0031	2026-02-11
`CVE-2024-51977`	7.0	5.3	0.7273	2025-06-25
`CVE-2023-7062`	6.7	8.8	0.0072	2024-07-10
`CVE-2026-49298`	6.6	8.8	0.0049	2026-06-01
`CVE-2024-22433`	6.4	8.8	0.0064	2024-02-06
`CVE-2023-46723`	6.3	8.9	0.0040	2023-10-31
`CVE-2018-10590`	6.2	7.5	0.0169	2018-05-15
`CVE-2022-23508`	6.2	8.8	0.0032	2023-01-09
`CVE-2016-10399`	6.1	7.5	0.0141	2017-07-27
`CVE-2023-4595`	6.0	7.5	0.0072	2023-11-23
`CVE-2026-21672`	6.0	8.8	0.0022	2026-03-12
`CVE-2020-37104`	5.9	7.5	0.0056	2026-02-11
`CVE-2019-25706`	5.9	7.5	0.0053	2026-04-12
`CVE-2026-27173`	5.9	8.7	0.0016	2026-05-19
`CVE-2021-21250`	5.8	7.7	0.0093	2021-01-15
`CVE-2023-54346`	5.8	7.5	0.0031	2026-05-05
`CVE-2018-11798`	5.7	6.5	0.0488	2019-01-07
`CVE-2022-4318`	5.7	7.8	0.0025	2023-09-25
`CVE-2025-61138`	5.7	7.5	0.0029	2025-11-20
`CVE-2026-15574`	5.7	7.5	0.0026	2026-07-13
`CVE-2021-40363`	5.6	7.8	0.0016	2022-02-09
`CVE-2025-68429`	5.6	7.3	0.0026	2025-12-17