File disclosure is a vulnerability that lets an attacker read files or data they should not be able to access. The exposed content may come from the application itself, the operating system, configuration files, logs, source code, or secrets stored on disk. Even when no code is executed, reading the wrong file can reveal credentials, API keys, session secrets, or internal paths that make later attacks easier.
In web security, file disclosure often appears when an upload, preview, download, or path-handling feature crosses a trust boundary and processes untrusted input too broadly. A crafted request may trick the application into returning local files instead of only the intended user content. Defenders look for strict path validation, safe file-access APIs, least-privilege file permissions, and careful review of attachment and image-processing pipelines. Patching is important, but so is treating every file-handling feature as security-sensitive, because a simple read access flaw can become the first step in a larger compromise.