Home/CWE/Exposure of Information Through Directory Listing
Weakness

Exposure of Information Through Directory Listing

CWE-548 · Variant · Draft

The product inappropriately exposes a directory listing with an index of all the resources located inside of the directory.

△

Weakness Relationships

Where this weakness sits in the CWE hierarchy. Walk up to broader classes or down to more specific variants.
Parent of this (broader)
ChildOfCWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
⚠

CVEs With This Weakness

55
A sample of the 55 CVEs tagged with this weakness.
CVECVE-2026-41933
CVECVE-2026-22860
CVECVE-2025-62396
CVECVE-2025-61685
CVECVE-2025-4909
CVECVE-2025-4807
CVECVE-2025-45320
CVECVE-2025-2827
CVECVE-2025-28170
CVECVE-2025-27906
CVECVE-2025-27452
CVECVE-2025-2652
◉

Nuclei Scanner Templates

7
Open-source Nuclei templates that detect this weakness class - an actionable scan-for-it pivot. Licensed under the ProjectDiscovery / Nuclei terms.
highJetBackup <= 2.0.9.7 - Sensitive Information Exposure via Directory Listing
mediumGLPI - Directory Listing and Session Exposure
mediumUmbraco CMS - Directory Listing Exposure
mediumAdobe ColdFusion CFIDE - Directory Listing
mediumWordPress FastDup <= 2.1.9 Sensitive Information Exposure - Directory Listing
mediumJoomla! Database File List
lowPrestaShop < 1.7.6.6 - Information Exposure via Upload Directory
External lookups - second-class, for what we don’t hold ourselves
MITRE CWE
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin