Unauthorized file access is a flaw where an application can read, write, or serve files outside the directory or permission boundary it was meant to use. This often happens when path handling is weak: crafted input such as ../ sequences, absolute paths, symbolic links, or unsafe file references can cause the program to leave its intended folder and touch sensitive data.
In cyber security, this matters because files often contain credentials, configuration secrets, user data, or source code. Attackers may use the bug to steal information, overwrite files, or trigger follow-on compromise. Defenses include strict path normalization, checking the resolved real path against an approved base directory, rejecting unsafe names, and running services with least privilege so even a bug cannot reach important files. Security reviews should treat file paths as trust boundaries, not just input strings.