CWE-433

Unparsed Raw Web Content Delivery

VariantIncomplete

Description

The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.

If code is stored in a file with an extension such as ".inc" or ".pl", and the web server does not have a handler for that extension, then the server will likely send the contents of the file directly to the requester without the pre-processing that was expected. When that file contains sensitive information such as database credentials, this may allow the attacker to compromise the application or associated components.

Hierarchy (View 1000)

Parents

CWE-219

Children

none

CVEs mapped to this weakness (4)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2017-16070	—	Hig	0.49	7.5	0.01	Jun 7, 2018	nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16065	Hackerone Node Openssl Node Module	Hig	0.49	7.5	0.01	Jun 7, 2018	openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16061	—	Hig	0.49	7.5	0.01	May 29, 2018	tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2026-31841	Hyperterse Hyperterse		0.00	—	0.00	Mar 12, 2026	Hyperterse is a tool-first MCP framework for building AI-ready backend surfaces from declarative config. Prior to v2.2.0, the search tool allows LLMs to search for tools using natural language. While returning results, Hyperterse also returned the raw SQL queries, exposing…

CVE-2017-16070HigJun 7, 2018
risk 0.49cvss 7.5epss 0.01
nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16065HigJun 7, 2018
Hackerone
Node Openssl Node Module
risk 0.49cvss 7.5epss 0.01
openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16061HigMay 29, 2018
risk 0.49cvss 7.5epss 0.01
tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2026-31841Mar 12, 2026
Hyperterse
Hyperterse
risk 0.00cvss —epss 0.00
Hyperterse is a tool-first MCP framework for building AI-ready backend surfaces from declarative config. Prior to v2.2.0, the search tool allows LLMs to search for tools using natural language. While returning results, Hyperterse also returned the raw SQL queries, exposing…