Weaknesses of type CWE-434

3,110 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2025-62016CRITICALWordPress Kallyas theme <= 4.22.0 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2024-10668MEDIUMAuth Bypass in QuickshareEPSS 0.4%CVE-2026-37430HIGHAn arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang-wms commit 75c15a allows attackers to execuEPSS 0.4%CVE-2026-20098HIGHCisco Meeting Management Arbitrary File Upload VulnerabilityEPSS 0.4%CVE-2025-2607MEDIUMphplaozhang LzCMS-LaoZhangBoKeXiTong HTTP POST Request upimage.html unrestricted uploadEPSS 0.4%CVE-2026-21625MEDIUMExtension - stackideas.com - Lack of mime type validation in EasyDiscuss component 1.0.0-5.0.15 for JoomlaEPSS 0.4%CVE-2018-25158HIGHChamilo LMS 1.11.8 Arbitrary File Upload via elfinderEPSS 0.4%CVE-2025-6667MEDIUMcode-projects Car Rental System add_cars.php unrestricted uploadEPSS 0.4%CVE-2025-12331MEDIUMWillow CMS add unrestricted uploadEPSS 0.4%CVE-2026-11579MEDIUMKali Forms < 2.4.17 - Unauthenticated Media UploadEPSS 0.4%CVE-2024-27480CRITICALgivanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload.EPSS 0.4%CVE-2024-25182CRITICALgivanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php.EPSS 0.4%CVE-2024-40693HIGHIBM Planning Analytics file uploadEPSS 0.4%CVE-2026-56414HIGHH.VIEW HV-500S6 IP Camera Unrestricted Upload of File with Dangerous TypeEPSS 0.4%CVE-2026-25648HIGHTraccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File UploadEPSS 0.4%CVE-2026-1742MEDIUMEFM ipTIME A8004T VPN Service timepro.cgi commit_vpncli_file_upload unrestricted uploadEPSS 0.4%CVE-2024-23811HIGHA vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application allows users to upload arbitrary files EPSS 0.4%CVE-2025-10000MEDIUMQyrr – simply and modern QR-Code creation <= 2.0.7 - Authenticated (Contributor+) Arbitrary File UploadEPSS 0.4%CVE-2026-2226MEDIUMDouPHP ZIP File file.php unrestricted uploadEPSS 0.4%CVE-2026-39598HIGHWordPress Academy LMS Pro plugin < 3.5.2 - Arbitrary File Upload vulnerabilityEPSS 0.4%