Weaknesses of type CWE-434

3,099 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2025-27082HIGHAuthenticated Remote Code Execution Vulnerabilities in AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface via Arbitrary File WriteEPSS 0.5%CVE-2025-12153HIGHFeatured Image via URL <= 0.1 - Authenticated (Contributor+) Arbitrary FIle UploadEPSS 0.5%CVE-2026-11419CRITICALPath Traversal in Altium Enterprise Server Vault UploadController Allows Arbitrary File WriteEPSS 0.5%CVE-2024-32809CRITICALWordPress ActiveDEMAND plugin <= 0.2.41 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2023-40731MEDIUMA vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application allows users to upload arbitrary filEPSS 0.5%CVE-2022-2746MEDIUMSourceCodester Simple Online Book Store System Admin_ add.php unrestricted uploadEPSS 0.5%CVE-2024-8164MEDIUMChengdu Everbrite Network Technology BeikeShop FileManagerController.php rename unrestricted uploadEPSS 0.5%CVE-2024-45076CRITICALIBM webMethods Integration code executionEPSS 0.5%CVE-2025-7917HIGHSimopro Technology｜WinMatrix3 Web package - Arbitrary File UploadEPSS 0.5%CVE-2024-8940CRITICALUnrestricted Upload of File with Dangerous Type vulnerability on ScriptcaseEPSS 0.5%CVE-2026-82187CRITICALWooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File UploadEPSS 0.5%CVE-2024-49611CRITICALWordPress Product Website Showcase plugin <= 1.0 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2025-4387HIGHAbandoned Cart Pro for WooCommerce <= 9.16.0 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 0.5%CVE-2026-4357CRITICALEmbed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File UploadEPSS 0.5%CVE-2025-5131MEDIUMTmall Demo uploadCategoryImage unrestricted uploadEPSS 0.5%CVE-2025-62050CRITICALWordPress Blogmatic theme <= 1.0.3 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2025-29009CRITICALWordPress Medical Prescription Attachment Plugin for WooCommerce <= 1.2.3 - Arbitrary File Upload VulnerabilityEPSS 0.5%CVE-2025-62056CRITICALWordPress News Event theme <= 1.0.1 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2024-51790CRITICALWordPress HB AUDIO GALLERY plugin <= 3.0 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2024-10766MEDIUMCodezips Free Exam Hall Seating Management System save_user.php unrestricted uploadEPSS 0.5%