Weaknesses of type CWE-434

3,112 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2025-14219MEDIUMCampcodes Retro Basketball Shoes Online Store admin_running.php unrestricted uploadEPSS 0.3%CVE-2025-13423MEDIUMCampcodes Retro Basketball Shoes Online Store admin_product.php unrestricted uploadEPSS 0.3%CVE-2025-15262MEDIUMBiggiDroid Simple PHP CMS Site Logo edit.php unrestricted uploadEPSS 0.3%CVE-2025-15197MEDIUMcode-projects/anirbandutta9 Content Management System/News-Buzz editposts.php unrestricted uploadEPSS 0.3%CVE-2025-46384HIGHCWE-434 Unrestricted Upload of File with Dangerous TypeEPSS 0.3%CVE-2024-45965MEDIUMContao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.xEPSS 0.3%CVE-2024-40553MEDIUMTmall_demo v2024.07.03 was discovered to contain an arbitrary file upload via the component uploadUserHeadImage.EPSS 0.3%CVE-2025-45855MEDIUMAn arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary EPSS 0.3%CVE-2025-2606MEDIUMSourceCodester Best Church Management Software soulwinning_crud.php unrestricted uploadEPSS 0.3%CVE-2025-2155HIGHArbitrary File Upload in EchoCCS's Specto CMEPSS 0.3%CVE-2026-28800MEDIUMNatro Macro: Malicious actions allowed through Discord RC Commands by any userEPSS 0.3%CVE-2024-8918HIGHFile Manager Pro <= 8.3.9 - Unauthenticated Limited JavaScript File UploadEPSS 0.3%CVE-2025-53251CRITICALWordPress Pin WP theme < 7.2 - Arbitrary File Upload VulnerabilityEPSS 0.3%CVE-2025-48396HIGHArbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has beenEPSS 0.3%CVE-2025-53213CRITICALWordPress ReachShip WooCommerce Multi-Carrier & Conditional Shipping <= 4.3.1 - Arbitrary File Upload VulnerabilityEPSS 0.3%CVE-2025-3169LOWProjeqtor saveAttachment.php unrestricted uploadEPSS 0.3%CVE-2025-15050MEDIUMcode-projects Student File Management System save_file.php unrestricted uploadEPSS 0.3%CVE-2026-9374MEDIUMyangzongzhuan RuoYi-Vue Common Upload Endpoint upload FileUploadUtils.upload unrestricted uploadEPSS 0.3%CVE-2025-27714MEDIUMINFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous TypeEPSS 0.3%CVE-2025-55061HIGHPriority - CWE-434 Unrestricted Upload of File with Dangerous TypeEPSS 0.3%