I am on a friends server and I have found a potential security flaw where I can access other sites files on the server. He says he is on a shared hosting and I am not sure yet if the other sites are his or not, he has to get back to me on that. In the meantime though I was wondering how do sites like godaddy deal with this issue? Do they put each account on the server into a sort of virtual server so you can access your other sites on your account but can not access sites on other accounts? It might be the case that his server is working properly and all the sites I can access are his sites anyway since they are under his account.

If they are all his sites then how can he prevent other sites from accessing other sites since some of them are for other peoples sites he manages for them.

  • It seems from the answers that there is some confusion as to what exactly potential security flaw where I can access other sites files means. I took it as file system access, where as the other two read something else entirely which is quite reasonable. And that caused me to think the question was not as clear enough. Can you define how you mean access other sites files for us? Perhaps that will help us provide better answers.
    – closetnoc
    May 8, 2014 at 4:49
  • What I mean is that from the filesystem of one site, a php file on my site, I can read,modify,delete files from another site by simply using something like unlink($path_to_other_sites_files),scandir($path_to_other_sites_files) or fopen($path_to_other_sites_files). I use PHP, so those are php functions.
    – Wes
    May 8, 2014 at 19:55
  • Excellent! I still think that there is file level security that needs to be applied, but there may be PHP and other language/application security that needs to be addressed too.
    – closetnoc
    May 8, 2014 at 20:13
  • "since they are under his account." - If these are "addon" (or "parked") domains within his account then yes you would be able to do this since all the files are stored under the same document root of the primary domain name. However, if these are entirely separate user accounts then you should not be able to do this.
    – MrWhite
    Sep 30, 2015 at 11:08

3 Answers 3


Generally this should not happen. I do not use a web host, but I used to be in that business and I do carve up some servers here so I have still have a hand in it.

Generally speaking, when a user creates several sites without creating a new user for each site, the one user can see all of the sites. Let say a second user is created, they can be within the same group as the first user that created the sites and have access to all the sites. This happens more times than people think. In reality, the two accounts should not be in the same group.

Typically, if I were to sell an account, that user would only have access to the web space I carve out for them. That user in turn can create users under their account that would have access to the web space created for them or can have admin access that allows more access. The safest thing that can be done is to create a user account for every website and that each website can only be accessed by that user or by the system admins which would require root access to be able to modify files settings and such.

It sounds like your friend either has goofed up, trusts you, or just does not know how to carve up and manage web space. It sounds like you have a huge security hole that needs to be plugged ASAP.


In my experience, shared server space usually exposes individual projects on different ports. (http://app.server.com:15432)

In your situation however, you can try messing around with the "Access-Control-Allow-Origin" headers and passing some regex as the parameter.


PHP it self has a security mechanism called open_basedir. From the official documentation, user will be 'jailed' on directory in his open_basedir parameter.

Most web-based hosting management (like ISPConfig) has impelemented feature to switching on/off this feature.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.