---
title: "WEB-APP-010 Framework Writable Folders Open to All Users"
canonical: https://openvapt.com/checks/WEB-APP-010.html
html: https://openvapt.com/checks/WEB-APP-010.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-APP-010 Framework Writable Folders Open to All Users

Checks Laravel and Symfony cache, log and storage folders for world-write permission.

- Domain: Web Apps
- Severity: Medium
- Control category: Access Control
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L`
- CIS Controls v8: 3.3
- NIST CSF 2.0: PR.AA-05, PR.DS-01
- CWE: CWE-732, CWE-94
- OWASP Top 10 2021: A05:2021
- OWASP ASVS 4.0.3: 14.1.3
- OWASP WSTG v4.2: WSTG-CONF-09
- NIST SP 800-53 Rev. 5: AC-3, AC-6, CM-5

## Why It Matters

chmod -R 777 storage is a common fix for permission errors. Laravel's bootstrap/cache and Symfony's var/cache hold compiled PHP that the framework includes on every request, so any local user who can write there runs code as the web server. Logs and sessions in storage are readable and forgeable too.

## How It Detects

For each Laravel (.env with APP_KEY) or Symfony (.env with APP_SECRET) project, stats storage, storage/logs, storage/framework, bootstrap/cache, var/cache and var/log next to the .env file (metadata only) and fails when any has the 'other write' bit set.

## How to Fix

chmod -R o-w storage bootstrap/cache var  and give the web server group write access instead: chgrp -R www-data storage bootstrap/cache && chmod -R g+w storage bootstrap/cache.

## How to Verify

```
find storage bootstrap/cache var -perm -0002 -type d  prints nothing.
```

## Learn the Theory

- [A6 Application Framework and CMS Configuration](https://openvapt.com/academy/a6.md)

## References

- [Laravel documentation, Deployment](https://laravel.com/docs/12.x/deployment)
- [Symfony documentation, Setting up or Fixing File Permissions](https://symfony.com/doc/current/setup/file_permissions.html)
- [OWASP WSTG-CONF-09, Test File Permission](https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/09-Test_File_Permission/)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/frameworks.go

Run it: `openvapt scan --only WEB-APP-010`. Read it offline: `openvapt explain WEB-APP-010`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-APP-010.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.