Weaknesses of type CWE-434

3,112 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2026-11839CRITICALArbitrary File Upload in Basarsoft's RotabanEPSS 0.3%CVE-2025-55061HIGHPriority - CWE-434 Unrestricted Upload of File with Dangerous TypeEPSS 0.3%CVE-2019-25229HIGHKentico Xperience <= 12.0.29 MVC Forms Unrestricted File UploadEPSS 0.3%CVE-2025-7100MEDIUMBoyunCMS Index.php unrestricted uploadEPSS 0.3%CVE-2025-53891MEDIUMTIME LINE has Improper File Validation in Upload SectionEPSS 0.3%CVE-2025-9841MEDIUMcode-projects Mobile Shop Management System AddNewProduct.php unrestricted uploadEPSS 0.3%CVE-2023-27753HIGHAn arbitrary file upload vulnerability in MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted PHP file.EPSS 0.3%CVE-2025-8859MEDIUMcode-projects eBlog Site File Upload save-slider.php unrestricted uploadEPSS 0.3%CVE-2024-12042MEDIUMMStore API – Create Native Android & iOS Apps On The Cloud <= 4.16.4 - Authenticated (Subscriber+) HTML File Upload (Stored Cross-Site Scripting)EPSS 0.3%CVE-2025-15109MEDIUMjackq XCMS upload.php unrestricted uploadEPSS 0.3%CVE-2025-11320MEDIUMzhuimengshaonian wisdom-education UploadController.java uploadFile unrestricted uploadEPSS 0.3%CVE-2026-24960CRITICALWordPress Charety theme < 2.0.2 - Arbitrary File Upload vulnerabilityEPSS 0.3%CVE-2026-48945MEDIUMJoomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26EPSS 0.3%CVE-2025-8526MEDIUMExrick xboot UploadController.java upload unrestricted uploadEPSS 0.3%CVE-2026-53649CRITICALJoro: Unauthenticated Cross-Origin Plugin Upload Leads to RCEEPSS 0.3%CVE-2026-1791LOWArbitrary File Upload Vulnerability in Operation and Maintenance Security GatewayEPSS 0.3%CVE-2025-9400MEDIUMYiFang CMS P_file.php mergeMultipartUpload unrestricted uploadEPSS 0.3%CVE-2025-69771CRITICALCross-Site Scripting (XSS) vulnerability in the subtitle loading function of the asbplayer Chrome Extension version 1.14.0 allows attackers EPSS 0.3%CVE-2025-8128MEDIUMzhousg letao product.js unrestricted uploadEPSS 0.3%CVE-2026-25413CRITICALWordPress WPBookit Pro plugin <= 1.6.18 - Arbitrary File Upload vulnerabilityEPSS 0.3%