Weaknesses of type CWE-434

3,255 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2025-34100CRITICALBuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File UploadEPSS 3.9%CVE-2020-6008—LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code executionEPSS 3.8%CVE-2012-10019CRITICALFront-end Editor < 2.3 - Arbitrary File UploadEPSS 3.8%CVE-2024-31777CRITICALFile Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.pEPSS 3.8%CVE-2021-24376—Autoptimize < 2.7.8 - Arbitrary File Upload via "Import Settings"EPSS 3.7%CVE-2020-26285HIGHWidget instances allows a hacker to inject an executable file on the server on OpenMageEPSS 3.7%CVE-2023-3049CRITICALFile Upload in TMT's LockcellEPSS 3.7%CVE-2018-11091CRITICALAn issue was discovered in MyBiz MyProcureNet 5.0.0. A malicious file can be uploaded to the webserver by an attacker. It is possible for anEPSS 3.6%CVE-2023-2246MEDIUMSourceCodester Online Pizza Ordering System unrestricted uploadEPSS 3.6%CVE-2021-22697—A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 aEPSS 3.6%CVE-2015-10144HIGHResponsive Thumbnail Slider < 1.0.1 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 3.6%CVE-2023-4739MEDIUMByzoro Smart S85F Management Platform updateos.php unrestricted uploadEPSS 3.6%CVE-2026-58480CRITICALBlocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachmentsEPSS 3.6%CVE-2025-54769HIGHKL-001-2025-016: Xorux LPAR2RRD File Upload Directory TraversalEPSS 3.6%CVE-2024-9290CRITICALSuper Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File UploadEPSS 3.5%CVE-2021-44159CRITICAL4MOSAn GCB Doctor - Unrestricted Upload of FileEPSS 3.5%CVE-2026-5524CRITICALDivi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' ParameterEPSS 3.5%CVE-2026-14894CRITICALSuper Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)EPSS 3.5%CVE-2026-1405CRITICALSlider Future <= 1.0.5 - Unauthenticated Arbitrary File UploadEPSS 3.5%CVE-2021-4462CRITICALEmployee Records System v1.0 Arbitrary File Upload RCEEPSS 3.4%