Weaknesses of type CWE-434

3,112 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2025-20375MEDIUMCisco Unified Contact Center Express Arbitrary File Upload VulnerabilityEPSS 0.4%CVE-2023-35018LOWIBM Security Verify Governance file uploadEPSS 0.4%CVE-2026-77681MEDIUMCodeAstro Online Job Portal update-profile.php unrestricted uploadEPSS 0.4%CVE-2026-14698MEDIUMSourceCodester Syllabus-Aligned Learning Management and Examination System upload_files.php unrestricted uploadEPSS 0.4%CVE-2026-85135MEDIUMILIAS MediaPool ZipAdapter.php uploadMultipleSubtitleFileObject unrestricted uploadEPSS 0.4%CVE-2026-90857MEDIUMSourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted uploadEPSS 0.4%CVE-2026-91849MEDIUMWuzhiCMS Avatar Upload index.php setAvatar unrestricted uploadEPSS 0.4%CVE-2026-14776MEDIUMSourceCodester Onlne Examination & Learning Management System Filename Extension upload_files.php pathinfo unrestricted uploadEPSS 0.4%CVE-2026-91005MEDIUMSourceCodester Online Faculty Clearance System Profile Picture Upload edit_picture.php move_uploaded_file unrestricted uploadEPSS 0.4%CVE-2026-82679MEDIUMdiem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted uploadEPSS 0.4%CVE-2025-15423MEDIUMEmpireSoft EmpireCMS connect.php CheckSaveTranFiletype unrestricted uploadEPSS 0.4%CVE-2026-85186MEDIUMitsourcecode Online Medicine Delivery System Customer Controller controller.php doupdateimage unrestricted uploadEPSS 0.4%CVE-2026-14777MEDIUMSourceCodester Onlne Examination & Learning Management System announcements.php unrestricted uploadEPSS 0.4%CVE-2026-14775MEDIUMSourceCodester Onlne Examination & Learning Management System process_lesson.php unrestricted uploadEPSS 0.4%CVE-2026-11344MEDIUMcode-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted uploadEPSS 0.4%CVE-2024-51991LOWOctober CMS Allows Unprotected SVG Rename in Media ManagerEPSS 0.4%CVE-2026-90519MEDIUMPHPGurukul Bank Locker Management System add-locker-form.php unrestricted uploadEPSS 0.4%CVE-2025-10085MEDIUMSourceCodester Pet Grooming Management Software manage_website.php unrestricted uploadEPSS 0.4%CVE-2023-43619—An issue was discovered in Croc through 9.6.5. A sender may send dangerous new files to a receiver, such as executable content or a .ssh/autEPSS 0.4%CVE-2026-29104LOWSuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRMEPSS 0.4%