The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.
If code is stored in a file with an extension such as ".inc" or ".pl", and the web server does not have a handler for that extension, then the server will likely send the contents of the file directly to the requester without the pre-processing that was expected. When that file contains sensitive information such as database credentials, this may allow the attacker to compromise the application or associated components.

Primary

Resultant

Implementation

Operation

Confidentiality
Read Application Data

Architecture and Design
Perform a type check before interpreting files.

Architecture and Design
Do not store sensitive information in files which may be misinterpreted.

The following code uses an include file to store database credentials:
database.inc

<?php$dbName = 'usersDB';$dbPassword = 'skjdh#67nkjd3$3$';?>

login.php

<?phpinclude('database.inc');$db = connectToDB($dbName, $dbPassword);$db.authenticateUser($username, $password);?>

If the server does not have an explicit handler set for .inc files it may send the contents of database.inc to an attacker without pre-processing, if the attacker requests the file directly. This will expose the database name and password.

CVE-2002-1886
".inc" file stored under web document root and returned unparsed by the server
https://www.cve.org/CVERecord?id=CVE-2002-1886

CVE-2002-2065
".inc" file stored under web document root and returned unparsed by the server
https://www.cve.org/CVERecord?id=CVE-2002-2065

CVE-2005-2029
".inc" file stored under web document root and returned unparsed by the server
https://www.cve.org/CVERecord?id=CVE-2005-2029

CVE-2001-0330
direct request to .pl file leaves it unparsed
https://www.cve.org/CVERecord?id=CVE-2001-0330

CVE-2002-0614
.inc file
https://www.cve.org/CVERecord?id=CVE-2002-0614

CVE-2004-2353
unparsed config.conf file
https://www.cve.org/CVERecord?id=CVE-2004-2353

CVE-2007-3365
Chain: uppercase file extensions causes web server to return script source code instead of executing the script.
https://www.cve.org/CVERecord?id=CVE-2007-3365

Unparsed Raw Web Content Delivery

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

This overlaps direct requests (CWE-425), alternate path (CWE-424), permissions (CWE-275), and sensitive file under web root (CWE-219).

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2008-10-14
updated Description, Other_Notes, Relationship_Notes

CWE Content Team
MITRE
2010-09-27
updated Description, Potential_Mitigations

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated References, Relationships

CWE Content Team
MITRE
2012-10-30
updated Demonstrative_Examples, Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Observed_Examples

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Weakness_Ordinalities