Weaknesses of type CWE-434

3,100 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2020-7847HIGHThe ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain EPSS 0.5%CVE-2024-31454MEDIUMPsiTransfer file integrity violation vulnerabilityEPSS 0.5%CVE-2024-31453MEDIUMPsiTransfer vulnerable to violation of the integrity of file distributionEPSS 0.5%CVE-2025-49071CRITICALWordPress Flozen < 1.5.1 - Arbitrary File Upload VulnerabilityEPSS 0.5%CVE-2025-12161HIGHSmart Auto Upload Images <= 1.2.0 - Authenticated (Contributor+) Arbitrary File UploadEPSS 0.5%CVE-2024-6117CRITICALHamastar MeetingHub Paperless Meetings - Unrestricted Upload of File with Dangerous TypeEPSS 0.5%CVE-2025-1388HIGHLearning Digital Orca HCM - Arbitrary File UploadEPSS 0.5%CVE-2026-40772CRITICALWordPress GeekyBot plugin <= 1.2.2 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2026-7852CRITICALUnrestricted File Upload in Limatek's LimRAD NACEPSS 0.5%CVE-2026-45444CRITICALWordPress Gift Cards For WooCommerce Pro plugin <= 4.2.6 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2026-14175CRITICALUnrestricted File Upload in Bilin Software's HUMANIST Digital Human ResourcesEPSS 0.5%CVE-2026-82970CRITICALWordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2026-57719CRITICALWordPress Aimogen Pro plugin <= 2.8.3 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2026-75327CRITICALIn DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload vEPSS 0.5%CVE-2026-66665CRITICALWordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2024-49652CRITICALWordPress 3D Work In Progress plugin <= 1.0.3 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2024-50511CRITICALWordPress WP donimedia carousel plugin <= 1.0.1 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2026-57700CRITICALWordPress OMGF Pro plugin <= 5.2.6 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2024-49669CRITICALWordPress INK Official plugin <= 4.1.2 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2026-73996CRITICALWordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerabilityEPSS 0.5%