CWE-433
Unparsed Raw Web Content Delivery
Extended description
If code is stored in a file with an extension such as ".inc" or ".pl", and the web server does not have a handler for that extension, then the server will likely send the contents of the file directly to the requester without the pre-processing that was expected. When that file contains sensitive information such as database credentials, this may allow the attacker to compromise the application or associated components.
Common consequences1
- ConfidentialityRead Application Data
Potential mitigations2
- Architecture and Design
Perform a type check before interpreting files.
- Architecture and Design
Do not store sensitive information in files which may be misinterpreted.
Relationships1
- ChildOfCWE-219
CVEs referencing this CWE4
| CVE | Description | Severity | EPSS | Flags | Modified |
|---|---|---|---|---|---|
| CVE-2017-16065 | openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. | HIGH7.5 | 1.18%p63 | 2024-11-21 | |
| CVE-2017-16070 | nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. | HIGH7.5 | 1.18%p63 | 2024-11-21 | |
| CVE-2017-16061 | tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. | HIGH7.5 | 1.11%p62 | 2024-11-21 | |
| CVE-2026-31841 | Hyperterse is a tool-first MCP framework for building AI-ready backend surfaces from declarative config. Prior to v2.2.0, the search tool allows LLMs to search for tools using natural language. While returning results, Hyperterse also returned the raw SQL queries, exposing statements which were supposed to be executed under the hood, and protected from being displayed publicly. This issue has been fixed as of v2.2.0. | MEDIUM6.5 | 0.18%p8 | 2026-03-19 |