Weaknesses of type CWE-434

3,091 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2018-25019—LearnDash < 2.5.4 - Unauthenticated Arbitrary File UploadEPSS 1.6%CVE-2024-52380CRITICALWordPress Picsmize plugin <= 1.0.0 - Arbitrary File Upload vulnerabilityEPSS 1.6%CVE-2025-3444MEDIUMLocal File InclusionEPSS 1.6%CVE-2023-6574MEDIUMByzoro Smart S20 HTTP POST Request updateos.php unrestricted uploadEPSS 1.6%CVE-2026-16330MEDIUMD-Link DNS-320 uploadify.php unrestricted uploadEPSS 1.6%CVE-2026-16447MEDIUMD-Link DNS-320 multi_uploadify.php unrestricted uploadEPSS 1.6%CVE-2026-16331MEDIUMD-Link DNS-320 save_ajax.php unrestricted uploadEPSS 1.6%CVE-2026-16327MEDIUMD-Link DNS-320 upload.php unrestricted uploadEPSS 1.6%CVE-2026-27540CRITICALWordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerabilityEPSS 1.6%CVE-2023-25828HIGHAuthenticate Remote Code Execution in Pluck CMSEPSS 1.6%CVE-2024-3022HIGHBookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.0.87 - Authenticated (Admin+) Arbitrary File UploadEPSS 1.6%CVE-2024-4033HIGHAll-in-One Video Gallery <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured imageEPSS 1.6%CVE-2022-42189HIGHEmlog Pro 1.6.0 plugins upload suffers from a remote code execution (RCE) vulnerability.EPSS 1.6%CVE-2025-5243CRITICALArbitrary File Upload in SMG Software's Information PortalEPSS 1.5%CVE-2025-68109CRITICALChurchCRM vulnerable to RCE with database restore functionalityEPSS 1.5%CVE-2013-10055CRITICALHavalite CMS Arbitary File Upload RCEEPSS 1.5%CVE-2025-55912HIGHAn issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php tEPSS 1.5%CVE-2023-6635HIGHEditorsKit <= 1.40.3 - Authenticated (Administrator+) Arbitrary File UploadEPSS 1.5%CVE-2023-39462MEDIUMTriangle MicroWorks SCADA Data Gateway Workspace Unrestricted Upload VulnerabilityEPSS 1.5%CVE-2023-25654CRITICALbaserCMS File Uploader Remote Code Execution (RCE) vulnerabilityEPSS 1.5%