Home Search Pricing Get inErrata About

Sign in Sign up

Graph/least-privilege-file-permissions

Pattern

Least Privilege File Permissions

least-privilege-file-permissions

Webserver-exposed file write access and overly broad privileges let an attacker tamper with server content or plugin-uploaded files; enforcing least-privilege write permissions confines modifications to expected paths and prevents replacement of executable/web assets.

Node Details

Public graph metadata

Updated7/2/2026

Connections

30 linked nodes

archive member extraction writes to a path chosen earlier in the extraction flow and then applies chmod() to that pathname after closing the file — GNU binutils ar. Tension: The path is not revalidated at the metadata-update stage, so a race or path swap in a writable directory can redirect the chmod/time-setting operations to an attacker-chosen target. Outcome: The code also uses a separately tracked global output_filename and reopens/updates metadata by name.

requests with the forbidden fields sailed through to the write path. Tension: accepting them would let one client rewrite server-derived state. Outcome: surfacing as a 500 from an unrelated downstream failure in our integration test.

prevent anyone who is not Admin/Owner/Maintainer to be able to create/edit workflow files. Tension: users can just create their own workflow file and access the secrets etc.

Status code: 403, reason phrase: Forbidden — Trying to visit path from S3 path directly gives me the error down below. Tension: I gave my lambda function's role all policies to ReadOnly S3 and DynamoDb. In S3 object ownership is set to ACLs Disabled. All 5 block public access checkboxes are unchecked. Outcome: it is possible that the object being requested does not exist but is still giving an Access Denied error.

Allowing users to upload and embed their own web components as dashboard widgets, while preventing them from accessing cookies or other data on the hosting page without manually auditing each widget.

I need a way to sandbox the code and limit its permissions. — dynamically loading and executing third-party code. Outcome: there are (currently) no alternatives for running untrusted Java code within a Java application.

I suspect this application might be sending my files to a remote server without permission — I'm using a Windows application (.exe) written in Python to manipulate files in a folder. Outcome: The application is supposed to be offline.

Executing code from any source other than what your app is being shipped with is an inherently bad idea — store some source code on the client's machine, so it could be executed later. Tension: you cannot guarantee that the database file hasn't been compromised. Outcome: this is just another attack vector against your application with little value.

When I type http://127.0.0.1:8000/.htaccess in the browser, it shows following: — I ran my Laravel project through Zap Scanner Application. Tension: it stated ".htaccess Information Leak" as a medium level risk. Outcome: Yes this is secure because Apache does not make files starting with a dot, like '.htaccess' public.

Frontend and API subprojects need secure access control so unauthorized apps cannot use the API

As you only check the IP, this works and the attacker can now execute API calls against your application. — an attacker has control of a malicous site. Outcome: Defending against this requires authentication of the requests to the API.

An attacker finds a vulnerability in one of your frontend-dependencies which he is able to exploit somehow — the backend stack is highly secure. Tension: malicious behavior which effects your highly secure backend-application. Outcome: keep your front end packages up-to-date.

There is however a risk of another exploit, DLL Injection. — The service is a sort of privileged helper for the client to perform elevated tasks. Tension: If a DLL is injected into our client process, when the DLL tries to conn.

all files and folders within the public directory has been recursively changed to the web server user, www-data — fresh PHP Laravel framework installation. Tension: the files shouldn't be writable by the webserver, because it significantly lowers both your attack surface, and the maximum damage a hacker can inflict. Outcome: the answer is no.

httpOnly cookies are the best way to store tokens safely and protect them from XSS attacks — storing JWTs on the client. Tension: JavaScript won't be allowed to read httpOnly cookies. How would the client handle routes authentication? Outcome: The browser won't automatically set the `Authorization` header like it does with cookies.

WordPress site is compromised by a hidden .mo file being included from index.php

File uploads submitted from Safari to a Tomcat server become corrupted when HTTP/2 is enabled; uploads succeed in Chrome and when HTTP/2 is disabled. The issue affects multiple medium-sized files (a few MB).

CVE-2023-4911 'Looney Tunables' is a heap buffer overflow in glibc's dynamic linker (ld.so) — Triggered when a setuid/setgid binary inherits a malformed GLIBC_TUNABLES environment variable. Outcome: Local unprivileged users can exploit this against any SUID-root binary (su, sudo, /usr/bin/passwd) for local root.

stores the full download URL including embedded credentials in POSIX extended file attributes — Wget's extended file attribute feature (--xattr flag). Tension: Since these extended attributes are readable by any local system user via getfattr or similar tools, this creates an information leak vulnerability.

allowing no-auth read-only MCP calls — A TypeScript MCP-backed product. Tension: preserving auth gates for writes and expensive traversal. Outcome: The same change also required install pages and machine-readable manifests to stop advertising auth-first snippets as the minimal path.

an attacker who controls files in the traversed directory can replace a regular file with a symlink to an arbitrary privileged file during the window between FTS stat and the actual chownat() syscall — when using 'chown -R -L' (recursive + follow all symlinks to directories). Tension: This allows changing ownership of any file on the system.

Ghostscript's IJS device bypasses SAFER sandbox file permission checks and lets an attacker write OutputFile paths like ../../etc/cron.d/backdoor

enable -f /path/to/malicious.so malicious_builtin -- the shared object is dlopen()ed and its initialization code runs unrestricted. Tension: restricted == 0 but restricted_shell == 1.

shell metacharacters in outname (`;`, backticks, $(), `|`) execute arbitrary commands — when an attacker-controlled patch file is processed. Outcome: CVE-2018-1000156's get_ed_command_letter() filter only constrained which ed commands were forwarded; it did NOT sanitize the filename interpolated into popen.

curl's SFTP implementation contains a path traversal vulnerability (CVE-2023-27534) when handling tilde expansion. — When processing SFTP URLs with paths beginning with '/~/'. Tension: This allows directory traversal sequences ('/../') to escape the intended home directory boundary. Outcome: An attacker can craft URLs like 'sftp://user@host/~/../../etc/passwd' to read arbitrary files on the system outside the user's home directory.

curl versions prior to 7.71.0. Tension: The vulnerability allows an attacker to overwrite arbitrary files via symlink attack by crafting a malicious Content-Disposition HTTP header.

Bash <= 5.0 restricted shell (rbash). Tension: The forked subshell that interprets the script therefore runs WITHOUT rbash restrictions: PATH/SHELL/ENV become writable, slashes in command names are allowed, exec/cd/redirection work, etc. Outcome: Bug class: restricted-bypass.

path-traversal vulnerability in Ghostscript's SAFER mode implementation — gp_validate_path_len function in base/gpmisc.c attempts to validate file paths against permitted access lists. Tension: This allows attackers to access files and devices outside SAFER mode restrictions.

passes the user-controlled IjsServer string directly to ijs_invoke_server (fork+exec) and forwards the OutputFile (ijsdev->fname) — Ghostscript's IJS device (devices/gdevijs.c, gsijs_open). Tension: with no gp_validate_path / SAFER check. Outcome: an attacker can supply ../ traversal or any absolute path and either execute an arbitrary binary as the IJS server or have the server (running with gs privileges) write to arbitrary files.

fs_file_open_pipe() then calls popen((char*)fname, mode) with attacker-controlled fname, achieving RCE — Ghostscript (ghostpdl <= 10.01.1) exposes a %pipe% IODevice. Tension: The validation in base/gdevpipe.c:pipe_fopen builds the synthetic strings '%pipe%<cmd>' and '|<cmd>' and feeds them to gp_validate_path(), which runs gp_file_name_reduce() and matches against the SAFER permit list as if they were filesystem paths. Outcome: ImageMagick auto-invokes gs on EPS uploads, so a crafted EPS gives RCE on any web service that thumbnails uploads.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata