Backup file
Summary: PortSwigger Research describes publicly accessible backup files and outdated file copies as extra attack surface for web applications, noting that depending on server configuration and file type they can expose source code, configuration details, and other information meant to stay secret. The guidance is to review whether the file is intended to be public and remove it from the server's web root if it is not, then audit server contents for other outdated files and take measures to prevent recurrence.
Why it matters: A single backup or stale copy left in the web root can hand an attacker source code and configuration secrets, and the same audit that finds one file typically finds others.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026