Weaknesses of type CWE-434

3,112 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2024-53811MEDIUMWordPress WDesignKit plugin <= 1.0.40 - Arbitrary File Upload vulnerabilityEPSS 0.3%CVE-2024-49676MEDIUMWordPress Custom Icons for Elementor plugin <= 0.3.3 - Arbitrary File Upload vulnerabilityEPSS 0.3%CVE-2025-7864MEDIUMthinkgem JeeSite FileUploadController.java upload unrestricted uploadEPSS 0.3%CVE-2026-16286CRITICALFile Upload in TRTEK Software's Software Repository ManagementEPSS 0.3%CVE-2024-50625HIGHAn issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipEPSS 0.3%CVE-2024-23762HIGHUnrestricted File Upload vulnerability in Content Manager feature in Gambio 4.9.2.0 allows attackers to execute arbitrary code via upload ofEPSS 0.3%CVE-2026-12215MEDIUMOTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute ForceEPSS 0.3%CVE-2025-0984HIGHArbitrary File Upload in Netoloji Software's E-FlowEPSS 0.3%CVE-2026-50093HIGHA vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All versionEPSS 0.3%CVE-2023-50897CRITICALWordPress Media File Renamer plugin <= 5.7.7 - Arbitrary File Rename lead to RCE vulnerabilityEPSS 0.3%CVE-2024-3344MEDIUMOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.8 - Authenticated (Author+) Limited File Upload to Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-45586HIGHAn issue in Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to arbitrarily overwrite files via supplying a crafted PUT request.EPSS 0.3%CVE-2025-64759HIGHHomarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG UploadEPSS 0.3%CVE-2025-5873MEDIUMeCharge Hardy Barth Salia PLCC Web UI firmware.php unrestricted uploadEPSS 0.3%CVE-2025-1835MEDIUMosuuu LightPicture Api.php upload unrestricted uploadEPSS 0.3%CVE-2025-13238MEDIUMBdtask Flight Booking Software Edit Profile edit unrestricted uploadEPSS 0.3%CVE-2025-9800MEDIUMSimStudioAI sim HTML File route.ts import unrestricted uploadEPSS 0.3%CVE-2026-2146MEDIUMguchengwuyue yshopmall co.yixiang.utils.FileUtil updateAvatar unrestricted uploadEPSS 0.3%CVE-2025-56295HIGHcode-projects Computer Laboratory System 1.0 has a file upload vulnerability. Staff can upload malicious files by uploading PHP backdoor filEPSS 0.3%CVE-2024-7987HIGHRockwell Automation ThinManager® ThinServer™ Information Disclosure and Remote Code Execution VulnerabilitiesEPSS 0.3%