Weaknesses of type CWE-434

3,091 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2023-3804MEDIUMChengdu Flash Flood Disaster Monitoring and Warning System FileHandler.ashx unrestricted uploadEPSS 0.9%CVE-2025-66802CRITICALSourcecodester Covid-19 Contact Tracing System 1.0 is vulnerable to RCE (Remote Code Execution). The application receives a reverse shell (pEPSS 0.9%CVE-2024-48454HIGHAn issue in SourceCodester Purchase Order Management System v1.0 allows a remote attacker to execute arbitrary code via the /admin?page=userEPSS 0.9%CVE-2026-30821HIGHFlowise: Arbitrary File Upload via MIME SpoofingEPSS 0.9%CVE-2023-42659CRITICALWS_FTP Server Arbitrary File UploadEPSS 0.9%CVE-2019-25630HIGHPhreeBooks ERP 5.2.3 Arbitrary File Upload via Image ManagerEPSS 0.9%CVE-2022-36452CRITICALA vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated attacker to upload maliEPSS 0.9%CVE-2026-80235CRITICALThinking Software Technology｜EFence - Arbitrary File UploadEPSS 0.9%CVE-2024-13333HIGHAdvanced File Manager 5.2.12 - 5.2.13 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 0.9%CVE-2026-6885CRITICALBorG Technology Corporation｜Borg SPM 2007 - Arbitrary File UploadEPSS 0.9%CVE-2024-35570CRITICALAn arbitrary file upload vulnerability in the component \controller\ImageUploadController.class of inxedu v2.0.6 allows attackers to executeEPSS 0.9%CVE-2023-1942MEDIUMSourceCodester Online Computer and Laptop Store Avatar unrestricted uploadEPSS 0.9%CVE-2023-3491HIGHUnrestricted Upload of File with Dangerous Type in fossbilling/fossbillingEPSS 0.9%CVE-2024-13448CRITICALThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_dataEPSS 0.9%CVE-2025-7075MEDIUMBlackVue Dashcam 590X HTTP Endpoint upload.cgi unrestricted uploadEPSS 0.9%CVE-2022-47854CRITICALi-librarian 4.10 is vulnerable to Arbitrary file upload in ajaxsupplement.php.EPSS 0.9%CVE-2023-3798MEDIUMChengdu Flash Flood Disaster Monitoring and Warning System upload.aspx unrestricted uploadEPSS 0.9%CVE-2023-48394HIGHKaifa Technology WebITR - Arbitrary File UploadEPSS 0.9%CVE-2023-1392MEDIUMSourceCodester Online Pizza Ordering System save_menu unrestricted uploadEPSS 0.9%CVE-2023-7091MEDIUMDreamer CMS uploadFile unrestricted uploadEPSS 0.9%