Weaknesses of type CWE-434

3,108 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2025-65875HIGHAn arbitrary file upload vulnerability in the AddFont() function of FPDF v1.86 and earlier allows attackers to execute arbitrary code via upEPSS 0.4%CVE-2024-7706MEDIUMFujian mwcms uploadfile.html uploadimage unrestricted uploadEPSS 0.4%CVE-2026-18143CRITICALRequest a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup HandlerEPSS 0.4%CVE-2025-6870MEDIUMSourceCodester Simple Company Website Content.php unrestricted uploadEPSS 0.4%CVE-2026-71434MEDIUMStatamic: Missing file upload validation on frontend forms allows uploading disallowed file typesEPSS 0.4%CVE-2025-4258MEDIUMzhangyanbo2007 youkefu MediaController.java upload unrestricted uploadEPSS 0.4%CVE-2025-46080MEDIUMHuoCMS V3.5.1 has a File Upload Vulnerability. An attacker can exploit this flaw to bypass whitelist restrictions and craft malicious files EPSS 0.4%CVE-2019-25673HIGHUniSharp Laravel File Manager v2.0.0-alpha7 Arbitrary File UploadEPSS 0.4%CVE-2025-10428MEDIUMSourceCodester Pet Grooming Management Software Setting seo_setting.php unrestricted uploadEPSS 0.4%CVE-2025-10427MEDIUMSourceCodester Pet Grooming Management Software user.php unrestricted uploadEPSS 0.4%CVE-2024-47528MEDIUMLibreNMS Contains a Stored XSS via File UploadEPSS 0.4%CVE-2025-15360MEDIUMnewbee-mall-plus Product Information Edit UploadController.java upload unrestricted uploadEPSS 0.4%CVE-2026-81236HIGHDell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unaEPSS 0.4%CVE-2026-15553MEDIUMRagic｜Enterprise Cloud Database - Arbitrary File UploadEPSS 0.4%CVE-2026-60032CRITICALJoomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0EPSS 0.4%CVE-2025-59835HIGHLangBot has a cross-directory file upload vulnerability, which could lead to system takeoverEPSS 0.4%CVE-2025-4735MEDIUMCampcodes Sales and Inventory System product.php unrestricted uploadEPSS 0.4%CVE-2025-5108MEDIUMzongzhige ShopXO ZIP File Payment.php Upload unrestricted uploadEPSS 0.4%CVE-2025-49885CRITICALWordPress Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin <= 5.0.6 - Arbitrary File Upload VulnerabilityEPSS 0.4%CVE-2025-4291MEDIUMIdeaCMS saveUpload unrestricted uploadEPSS 0.4%