Weaknesses of type CWE-434

3,103 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2026-44566HIGHOpen WebUI: Arbitrary File Upload and Path TraversalEPSS 0.5%CVE-2025-11658MEDIUMProjectsAndPrograms School Management System changeSllyabus.php unrestricted uploadEPSS 0.5%CVE-2025-10424MEDIUM1000projects Online Student Project Report Submission and Evaluation System faculty_controller.php unrestricted uploadEPSS 0.5%CVE-2025-7181MEDIUMcode-projects Staff Audit System test.php unrestricted uploadEPSS 0.5%CVE-2022-42443LOWTrusteer for mobile file uploadEPSS 0.5%CVE-2025-10616MEDIUMitsourcecode E-Commerce Website users.php unrestricted uploadEPSS 0.5%CVE-2025-59710HIGHAn issue was discovered in Biztalk360 before 11.5. Because of incorrect access control, any user is able to request the loading a DLL file. EPSS 0.5%CVE-2025-8798MEDIUMoitcode samarium Create Product product unrestricted uploadEPSS 0.5%CVE-2025-7627MEDIUMYiJiuSmile kkFileViewOfficeEdit fileUpload unrestricted uploadEPSS 0.5%CVE-2025-1165MEDIUMLumsoft ERP FileUploadApi.ashx DoWebUpload unrestricted uploadEPSS 0.5%CVE-2025-10116MEDIUMSiempreCMS file_upload.php unrestricted uploadEPSS 0.5%CVE-2025-6435HIGHSave as in Devtools could download files without sanitizing the extensionEPSS 0.5%CVE-2025-14530MEDIUMSourceCodester Real Estate Property Listing App property.php unrestricted uploadEPSS 0.5%CVE-2025-47637CRITICALWordPress STAGGS plugin <= 2.11.0 - Arbitrary File Upload VulnerabilityEPSS 0.5%CVE-2020-36825MEDIUMcyberaz0r WebRAT api.php download_file unrestricted uploadEPSS 0.5%CVE-2024-46101CRITICALGDidees CMS <= v3.9.1 has a file upload vulnerability.EPSS 0.5%CVE-2023-30968MEDIUMStored XSS in gaiaEPSS 0.5%CVE-2026-10072HIGHInterinfo｜DreamMaker - Arbitrary File UploadEPSS 0.5%CVE-2025-49060CRITICALWordPress Wastia theme < 1.1.3 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2024-30533HIGHWordPress Layouts for Elementor plugin < 1.8 - Arbitrary File Upload vulnerabilityEPSS 0.5%