Weaknesses of type CWE-434

3,105 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2025-32652CRITICALWordPress Solace Extra plugin <= 1.3.1 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2025-46264CRITICALWordPress PowerPress Podcasting <= 11.12.5 - Arbitrary File Upload VulnerabilityEPSS 0.4%CVE-2025-8775MEDIUMQiyuesuo Eelectronic Signature Platform Scheduled Task upload execute unrestricted uploadEPSS 0.4%CVE-2026-46489HIGHSolidInvoice: Unrestricted file upload with no MIME validation allows stored XSS via malicious SVG logoEPSS 0.4%CVE-2025-68555CRITICALWordPress Nutrie theme < 2.0.1 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2025-68554CRITICALWordPress Keenarch theme < 2.0.1 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2025-67079CRITICALFile upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL engine of the Imagick lEPSS 0.4%CVE-2024-37179HIGHInsecure File Operations vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)EPSS 0.4%CVE-2025-2687MEDIUMPHPGurukul eLearning System Image index.php unrestricted uploadEPSS 0.4%CVE-2025-32202CRITICALWordPress Insert or Embed Articulate Content into WordPress plugin <= 4.3000000025 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2021-47819CRITICALProjeQtOr Project Management 9.1.4 - Remote Code ExecutionEPSS 0.4%CVE-2025-52239CRITICALAn arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file.EPSS 0.4%CVE-2026-16548MEDIUMBit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response EndpointEPSS 0.4%CVE-2023-6127MEDIUMUnrestricted Upload of File with Dangerous Type in salesagility/suitecrmEPSS 0.4%CVE-2025-69129CRITICALWordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin <= 1.0.7 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2023-32686HIGHkiwitcms vulnerable to stored XSS via unrestricted files uploadEPSS 0.4%CVE-2025-7898MEDIUMCodecanyon iDentSoft Account Setting Page updateSetting unrestricted uploadEPSS 0.4%CVE-2026-82629MEDIUMjeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted uploadEPSS 0.4%CVE-2024-25627LOWCross-Site Scripting (XSS) via File Upload in Alf.ioEPSS 0.4%CVE-2026-9053MEDIUMMothra would respect a default value given by a website for HTML file upload forms. An attacker could craft a website with a malicious defauEPSS 0.4%