Weaknesses of type CWE-434

3,112 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2026-24729CRITICALInterinfo DreamMaker - Unrestricted Upload of File with Dangerous TypeEPSS 0.4%CVE-2025-10615MEDIUMitsourcecode E-Commerce Website products.php unrestricted uploadEPSS 0.4%CVE-2025-13185MEDIUMBdtask/CodeCanyon News365 profile unrestricted uploadEPSS 0.4%CVE-2025-8344MEDIUMopenviglet shio ShStaticFileAPI.java shStaticFileUpload unrestricted uploadEPSS 0.4%CVE-2023-25365HIGHCross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3EPSS 0.4%CVE-2025-8171MEDIUMcode-projects Document Management System insert.php unrestricted uploadEPSS 0.4%CVE-2026-0566MEDIUMcode-projects Content Management System edit_posts.php unrestricted uploadEPSS 0.4%CVE-2025-13411MEDIUMCampcodes Retro Basketball Shoes Online Store admin_football.php unrestricted uploadEPSS 0.4%CVE-2024-11390MEDIUMKibana Unrestricted Upload of File with Dangerous Type Can Lead to XSSEPSS 0.4%CVE-2026-1813MEDIUMbolo-blog bolo-solo FreeMarker Template PicUploadProcessor.java unrestricted uploadEPSS 0.4%CVE-2025-8265MEDIUM299Ko CMS File Management view unrestricted uploadEPSS 0.4%CVE-2026-6211HIGHArbitrary File Upload in Global IT's WEOLLEPSS 0.4%CVE-2025-67706MEDIUMUnvalidated File Upload vulnerability in ArcGIS Server.EPSS 0.4%CVE-2025-28951CRITICALWordPress Bulk Featured Image plugin <= 1.2.4 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2025-61165CRITICALAn arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of cohere North AI v1.1.5 allows attackers to exeute arbitEPSS 0.4%CVE-2025-9415MEDIUMGreenCMS index.php unrestricted uploadEPSS 0.4%CVE-2026-32278HIGHConnect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form PluginEPSS 0.4%CVE-2026-22783CRITICALIris Allows Arbitrary File Deletion via Mass Assignment in Datastore File ManagementEPSS 0.4%CVE-2025-0645HIGHArbitrary File Upload in Narkom Communication Technologies' Pyxis SignageEPSS 0.4%CVE-2025-2031MEDIUMChestnutCMS upload uploadFile unrestricted uploadEPSS 0.4%