Weaknesses of type CWE-434

3,105 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2026-9053MEDIUMMothra would respect a default value given by a website for HTML file upload forms. An attacker could craft a website with a malicious defauEPSS 0.4%CVE-2025-47642CRITICALWordPress Ajar in5 Embed plugin <= 3.1.5 - Arbitrary File Upload VulnerabilityEPSS 0.4%CVE-2026-74767HIGHUnbounded DAA Decompression in Pandora Allows Denial of Service via Decompression BombEPSS 0.4%CVE-2025-24775CRITICALWordPress Forms <= 2.9.0 - Arbitrary File Upload VulnerabilityEPSS 0.4%CVE-2026-41517NONEEmlog: Remote Code Execution via Malicious Plugin UploadEPSS 0.4%CVE-2026-74803CRITICALJoomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64EPSS 0.4%CVE-2024-6730MEDIUMNanjing Xingyuantu Technology SparkShop uploadFile unrestricted uploadEPSS 0.4%CVE-2024-14046MEDIUMOpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted uploadEPSS 0.4%CVE-2025-57460CRITICALFile upload vulnerability in machsol machpanel 8.0.32 allows attacker to gain a webshell.EPSS 0.4%CVE-2025-10083MEDIUMSourceCodester Pet Grooming Management Software profile.php unrestricted uploadEPSS 0.4%CVE-2026-44097MEDIUMFile Upload vulnerabilityEPSS 0.4%CVE-2026-28192CRITICALWordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2026-12684MEDIUMCustomer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_mediaEPSS 0.4%CVE-2024-13144MEDIUMzhenfeng13 My-Blog BlogController.java uploadFileByEditomd unrestricted uploadEPSS 0.4%CVE-2024-51208HIGHFile Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0 allows local attackers to upload a malicious PEPSS 0.4%CVE-2024-13145MEDIUMzhenfeng13 My-Blog uploadController. java upload unrestricted uploadEPSS 0.4%CVE-2024-13022MEDIUMtaisan tarzan-cms Article Management UploadController.java UploadResponse unrestricted uploadEPSS 0.4%CVE-2026-36387MEDIUMA Remote Code Execution vulnerability was found in CODEASTRO Membership Management System v1.0 in /add_members.php. This vulnerability affecEPSS 0.4%CVE-2025-53283CRITICALWordPress Drop Uploader for CF7 - Drag&Drop File Uploader Addon Plugin <= 2.4.1 - Arbitrary File Upload VulnerabilityEPSS 0.4%CVE-2025-60235CRITICALWordPress Support Ticket System for WooCommerce plugin <= 2.0.7 - Arbitrary File Upload vulnerabilityEPSS 0.4%