Security

What is Storage of File With Sensitive Data (CWE-220)?

PenScan's guide to CWE-220, Storage of File With Sensitive Data Under FTP Root. Learn how it works, real-world examples, and how to prevent this...

Shreya Pillai July 28, 2026 5 min read Security

AI-friendly summary

What it is: Storage of File With Sensitive Data Under FTP Root (CWE-220) is a type of security misconfiguration vulnerability that occurs when an application stores sensitive data under the FTP server root with insufficient access control, making it accessible to untrusted parties.

Why it matters: This vulnerability can lead to confidentiality breaches due to unauthorized access to sensitive data. It's essential to prevent this vulnerability by following best practices and using secure protocols for data transmission.

How to fix it: To fix Storage of File With Sensitive Data Under FTP Root, avoid storing information under the FTP root directory and set access control permissions to prevent reading/writing of sensitive files inside/outside of the FTP directory.

TL;DR: Storage of File With Sensitive Data Under FTP Root (CWE-220) occurs when an application stores sensitive data under the FTP server root with insufficient access control, making it accessible to untrusted parties. To prevent this vulnerability, avoid storing information under the FTP root directory and set access control permissions.

Field	Value
CWE ID	CWE-220
OWASP Category	None
CAPEC	None known
Typical Severity	Critical
Affected Technologies	FTP servers, web applications, file systems
Detection Difficulty	Moderate
Last Updated	2026-07-28

What is Storage of File With Sensitive Data Under FTP Root?

Storage of File With Sensitive Data Under FTP Root (CWE-220) is a type of security misconfiguration vulnerability that occurs when an application stores sensitive data under the FTP server root with insufficient access control, making it accessible to untrusted parties. As defined by the MITRE Corporation under CWE-220.

Quick Summary

Storage of File With Sensitive Data Under FTP Root can lead to confidentiality breaches due to unauthorized access to sensitive data. It’s essential to prevent this vulnerability by following best practices and using secure protocols for data transmission. PenScan’s automated scanners actively test for CWE-220, identifying potential vulnerabilities in your application.

Storage of File With Sensitive Data Under FTP Root Overview

What

Storage of File With Sensitive Data Under FTP Root occurs when an application stores sensitive data under the FTP server root with insufficient access control, making it accessible to untrusted parties.

Why it matters

This vulnerability can lead to confidentiality breaches due to unauthorized access to sensitive data. It’s essential to prevent this vulnerability by following best practices and using secure protocols for data transmission.

Where it occurs

Storage of File With Sensitive Data Under FTP Root can occur in any application that uses an FTP server, including web applications and file systems.

Who is affected

Any user who has access to the FTP server or the application’s file system may be able to exploit this vulnerability.

Who is NOT affected

Applications that never construct paths/queries/commands from external input are not affected by this vulnerability.

How Storage of File With Sensitive Data Under FTP Root Works

Root Cause

The root cause of Storage of File With Sensitive Data Under FTP Root is the storage of sensitive data under the FTP server root with insufficient access control, making it accessible to untrusted parties.

Attack Flow

An attacker gains access to the FTP server or the application’s file system.
The attacker uses their access to retrieve sensitive data stored under the FTP server root.
The attacker exploits the vulnerability by accessing the sensitive data without proper authorization.

Prerequisites to Exploit

The attacker must have access to the FTP server or the application’s file system.
The application must store sensitive data under the FTP server root with insufficient access control.

Vulnerable Code

import os

# Store sensitive data in a file under the FTP server root
with open('/path/to/ftp/root/sensitive_data.txt', 'w') as f:
    f.write('Sensitive data')

The vulnerable code above stores sensitive data in a file under the FTP server root without proper access control, making it accessible to untrusted parties.

Secure Code

import os

# Store sensitive data in a secure location with proper access control
with open('/path/to/secure/location/sensitive_data.txt', 'w') as f:
    f.write('Sensitive data')

The secure code above stores sensitive data in a secure location with proper access control, preventing unauthorized access.

Business Impact of Storage of File With Sensitive Data Under FTP Root

Confidentiality breaches due to unauthorized access to sensitive data.
Financial losses due to data theft or compromise.
Compliance issues due to failure to protect sensitive data.

Storage of File With Sensitive Data Under FTP Root Attack Scenario

An attacker gains access to the FTP server or the application’s file system.
The attacker uses their access to retrieve sensitive data stored under the FTP server root.
The attacker exploits the vulnerability by accessing the sensitive data without proper authorization.

How to Detect Storage of File With Sensitive Data Under FTP Root

Manual Testing

Review access control permissions for files and directories under the FTP server root.
Verify that sensitive data is not stored in plaintext or with insufficient access control.

Automated Scanners (SAST / DAST)

Use automated scanners like PenScan to identify potential vulnerabilities related to CWE-220.
Contrast what static analysis catches here vs. what needs dynamic/runtime testing to find, specific to this weakness.

PenScan Detection

PenScan’s automated scanners actively test for CWE-220, identifying potential vulnerabilities in your application.

False Positive Guidance

Be cautious of false positives due to context that a scanner can’t see.
Verify the presence of sensitive data and access control permissions before flagging a vulnerability.

How to Fix Storage of File With Sensitive Data Under FTP Root

Avoid storing information under the FTP root directory.
Set access control permissions to prevent reading/writing of sensitive files inside/outside of the FTP directory.

Framework-Specific Fixes for Storage of File With Sensitive Data Under FTP Root

Java

// Store sensitive data in a secure location with proper access control
File file = new File("/path/to/secure/location/sensitive_data.txt");
file.createNewFile();

Node.js

// Store sensitive data in a secure location with proper access control
const fs = require('fs');
fs.writeFileSync('/path/to/secure/location/sensitive_data.txt', 'Sensitive data');

Python/Django

# Store sensitive data in a secure location with proper access control
with open('/path/to/secure/location/sensitive_data.txt', 'w') as f:
    f.write('Sensitive data')

How to Ask AI to Check Your Code for Storage of File With Sensitive Data Under FTP Root

Review the following Python code block for potential CWE-220 Storage of File With Sensitive Data Under FTP Root vulnerabilities and rewrite it using proper access control:

import os

# Store sensitive data in a file under the FTP server root
with open('/path/to/ftp/root/sensitive_data.txt', 'w') as f:
    f.write('Sensitive data')

Rewrite the code to use proper access control, such as storing sensitive data in a secure location with restricted access.

Storage of File With Sensitive Data Under FTP Root Best Practices Checklist

✅ Avoid storing information under the FTP root directory. ✅ Set access control permissions to prevent reading/writing of sensitive files inside/outside of the FTP directory. ✅ Verify return values from file operations. ✅ Use secure protocols for data transmission.

Storage of File With Sensitive Data Under FTP Root FAQ

How does Storage of File With Sensitive Data Under FTP Root occur?

What are the common consequences of Storage of File With Sensitive Data Under FTP Root?

The common consequences of Storage of File With Sensitive Data Under FTP Root include confidentiality breaches due to unauthorized access to sensitive data.

How can I prevent Storage of File With Sensitive Data Under FTP Root in my application?

To prevent Storage of File With Sensitive Data Under FTP Root, avoid storing information under the FTP root directory and set access control permissions to prevent reading/writing of sensitive files inside/outside of the FTP directory.

What are some best practices for preventing Storage of File With Sensitive Data Under FTP Root?

Some best practices include verifying return values from file operations, using secure protocols for data transmission, and regularly reviewing access control permissions.

Can you provide an example of how to fix Storage of File With Sensitive Data Under FTP Root in a Java application?

Yes, here is an example of how to fix Storage of File With Sensitive Data Under FTP Root in a Java application by using the File class to securely store and access files.

How can I use AI to check my code for Storage of File With Sensitive Data Under FTP Root?

You can use AI-powered coding assistants like PenScan’s automated scanners to review your code and identify potential vulnerabilities related to CWE-220.

What are some common mistakes that lead to Storage of File With Sensitive Data Under FTP Root?

Some common mistakes include storing sensitive data in plaintext, using insecure protocols for data transmission, and failing to properly configure access control permissions.

CWE ID	Name	Relationship
CWE-552	Files or Directories Accessible to External Parties	ChildOf

References

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Storage of File With Sensitive Data Under FTP Root and other risks before an attacker does.