# Cwe 552 Files Accessible Externally

> Use this skill when you need to remediate CWE-552 (Files Accessible to External Parties) vulnerabilities in Java code. Triggers on SAST findings, security reviews, or when fixing files accessible to external parties issues.

- Skill: `developerscoffee/cwe-552-files-accessible-externally` (Agent Skill)
- Install (CLI): `npx skillmds@latest add developerscoffee/cwe-552-files-accessible-externally`
- Raw SKILL.md: https://api.skillmd.com/api/skills/developerscoffee/cwe-552-files-accessible-externally/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: DevelopersCoffee (https://skillmd.com/u/developerscoffee)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/developerscoffee/cwe-552-files-accessible-externally

---


# CWE-552 Files Accessible to External Parties

## Description

Files Accessible to External Parties

Reference:
https://cwe.mitre.org/data/definitions/552.html


**OWASP Category**: A01:2021 – Broken Access Control


---

## Vulnerable Pattern


### ❌ Example 1: Vulnerable Pattern

```java
// VULNERABLE: Serving files without access control
@GetMapping("/files/{filename}")
public ResponseEntity<Resource> getFile(@PathVariable String filename) {
    Path path = Paths.get("/uploads/" + filename);
    Resource resource = new FileSystemResource(path);
    return ResponseEntity.ok().body(resource);
}
```


**Why it's vulnerable:** This pattern is vulnerable to Files Accessible to External Parties




---

## Deterministic Fix


### ✅ Secure Implementation: Secure Implementation

```java
// SECURE: Validate access and sanitize filename
@GetMapping("/files/{filename}")
public ResponseEntity<Resource> getFile(@PathVariable String filename, Authentication auth) {
    // Sanitize filename
    String safeName = Paths.get(filename).getFileName().toString();
    // Verify user has access
    FileMetadata meta = fileService.getMetadata(safeName);
    if (!meta.canAccess(auth.getName())) {
        throw new AccessDeniedException("Access denied");
    }
    Path path = uploadDir.resolve(safeName);
    return ResponseEntity.ok().body(new FileSystemResource(path));
}
```


**Why it's secure:** Implements proper protection against Files Accessible to External Parties




---

## Detection Pattern

Look for these patterns in your codebase:


```bash
# Find file serving endpoints
grep -rn "FileSystemResource\\|getFile\\|download" --include="*Controller.java"
```



---

## Remediation Steps


1. Validate user authorization before serving files

2. Sanitize filenames to prevent path traversal

3. Store files outside web root

4. Implement access control lists for files


---

## Key Imports

```java

import org.springframework.core.io.FileSystemResource;

import java.nio.file.Paths;

```

---

## Verification

After remediation:


- Run SAST scanner to confirm vulnerability is resolved

- Review all instances of the vulnerable pattern

- Add unit tests that verify the secure implementation

- Check for similar patterns in related code


---

## Trigger Examples

```
Fix CWE-552 vulnerability
Resolve Files Accessible to External Parties issue
Secure this Java code against files accessible to external parties
SAST reports CWE-552
```

---

## Common Vulnerable Locations

| Layer | Files | Patterns |
|-------|-------|----------|

| Controller | `*Controller.java` | User input handling |

| Service | `*Service.java` | Business logic |

| Repository | `*Repository.java` | Data access |


---

## References


- [CWE-552: Files Accessible Externally](https://cwe.mitre.org/data/definitions/552.html)


---

**Source**: Generated by [Java CWE Security Skills Generator](https://github.com/DevelopersCoffee/java-cwe-security-skills)
**Last Updated**: 2026-03-07