A Public sitemap.xml Isn't a Vulnerability, But What It Lists Might Be
Not every closed report is wrong to close. This one is a case where the verdict was fair, but the report also stumbled onto a detail worth separating out from the “just found a file” pile.
The finding
The target’s sitemap.xml was reachable and enumerable:
https://<REDACTED_DOMAIN>/sitemap.xml
On its own, that’s routine. Sitemaps exist specifically to tell search engines (and anyone else looking) which URLs exist on a site. But the file also accepted a pagination parameter:
https://<REDACTED_DOMAIN>/sitemap.xml?first=d
Paging through it this way surfaced additional listed entries, user profile URLs and some less-common program pages, that weren’t necessarily reachable through normal site navigation. Some of those pages returned information that wasn’t obviously meant to be casually browsable.
The triage response
The report was closed as Informative:
“Files such as robots.txt, sitemap.xml or .well-known/assetlinks.json are intentionally designed to be public. Whereas, files such as package.json or composer.json, although not designed to be public, do not hold any sensitive information. As a result, we will be closing this report as informative.”
That reasoning is correct as far as it goes. A sitemap existing, and listing pages, is the file doing its job. Closing a report that stops at “I found sitemap.xml” is the right call almost every time.
Where the nuance actually is
The part that’s worth separating out isn’t “a sitemap exists”, it’s “pagination through the sitemap surfaced entries that weren’t linked anywhere a normal visitor would find them.” Those are two different claims:
- “This file is public and lists public pages.” Not a bug. That’s the intended function of a sitemap.
- “Paginating this file surfaces pages that were otherwise unlisted and undiscoverable.” This is closer to an enumeration or information-disclosure question, and it depends entirely on what’s on the other end of those URLs. If the pages themselves have no access control problem, it’s still not a vulnerability, just a faster way to find pages that were always technically public. If any of those pages assumed “nobody will find this because it isn’t linked”, that’s a security-through-obscurity problem the sitemap merely revealed, not caused.
In this case, the pages reachable through the extra sitemap entries didn’t have an underlying access control failure, so the triage call to close it stands. The lesson isn’t about this specific file, it’s about the difference between “a public file exists” and “this public file happens to make enumeration of other content faster.”
Takeaway
sitemap.xml, robots.txt, and .well-known/* files are public by design, reporting their mere existence is close to always going to close as Informative or Not Applicable, and that’s the correct outcome. The only version of this report class that has legs is when what the file enumerates leads to content that was supposed to be access-controlled and isn’t, at which point the story isn’t “I found a sitemap” anymore, it’s the access control failure on whatever the sitemap pointed to.