Definition

MITRE’s description of CWE-548: The product inappropriately exposes a directory listing with an index of all the resources located inside of the directory.

Common consequences MITRE lists

  • Confidentiality: Read Files or Directories

Why it matters

A listing reveals every file name, including backups, exports and uploads that were never linked, and guides an attacker to them.

How to prevent it

  • Turn directory listing off in every web server and static-file middleware (autoindex off, Options -Indexes).
  • Serve only allowlisted file extensions from a clean build directory.
  • Request each static folder after deployment and confirm no listing is returned.

Guides on this site

Main subject · Guide

Ship without debug modes, verbose errors or exposed files

Turn off debug output, publish an allowlisted build and probe each deployment for exposed files and endpoints.

References

  1. CWE-548 in the MITRE CWE list (version 4.20)

List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.

CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.