CWE-530 (将备份文件暴露给非授权控制范围) — Vulnerability Class 10

CWE-530 represents a critical information exposure weakness where sensitive backup files are inadvertently stored in directories accessible to unauthorized actors. Attackers typically exploit this vulnerability by probing web servers for common backup extensions, such as .bak, .old, or .~bk, to retrieve outdated source code or configuration data. These files often contain hardcoded credentials, database connection strings, or proprietary logic that was previously discarded but remains accessible in the webroot. To mitigate this risk, developers must implement strict access controls and ensure that backup files are stored outside the public document root. Additionally, automated deployment pipelines should be configured to automatically purge or securely archive backup files after successful updates, preventing them from lingering in accessible locations where they can be harvested by malicious actors seeking initial footholds.