Weaknesses of type CWE-434

3,091 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2023-53868HIGHCoppermine Gallery 1.6.25 Remote Code Execution via Plugin UploadEPSS 0.9%CVE-2024-31345CRITICALWordPress Auto Poster plugin <= 1.2 - Arbitrary File Upload vulnerabilityEPSS 0.9%CVE-2026-13457HIGHInstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key DisclosureEPSS 0.9%CVE-2025-3125MEDIUMAuthenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code ExecutionEPSS 0.8%CVE-2021-37194—A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 onlEPSS 0.8%CVE-2023-6102MEDIUMMaiwei Safety Production Control Platform unrestricted uploadEPSS 0.8%CVE-2026-16060CRITICALInsert or Embed Articulate Content into WordPress <= 4.3000000027 - Editor+ Arbitrary File UploadEPSS 0.8%CVE-2024-13908HIGHSMTP by BestWebSoft <= 1.1.9 - Authenticated (Administrator+) Arbitrary File UploadEPSS 0.8%CVE-2023-47706MEDIUMIBM Security Guardium Key Lifecycle Manager file uploadEPSS 0.8%CVE-2017-7429HIGHFix for NetIQ shell code uploadEPSS 0.8%CVE-2023-6850MEDIUMkalcaddle KodExplorer API Endpoint unrestricted uploadEPSS 0.8%CVE-2025-54082HIGHnova-tiptap has an Unauthenticated Arbitrary File Upload VulnerabilityEPSS 0.8%CVE-2023-25444CRITICALWordPress JS Help Desk – Best Help Desk & Support Plugin plugin <= 2.7.7 - Arbitrary File Upload vulnerabilityEPSS 0.8%CVE-2023-7181MEDIUMMuyun DedeBIZ Add Attachment unrestricted uploadEPSS 0.8%CVE-2024-58348CRITICALWordPress Background Image Cropper 1.2 Remote Code ExecutionEPSS 0.8%CVE-2023-31585CRITICALGrocery-CMS-PHP-Restful-API v1.3 is vulnerable to File Upload via /admin/add-category.php.EPSS 0.8%CVE-2026-33647HIGHAVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File UploadEPSS 0.8%CVE-2025-47187HIGHA vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference UnEPSS 0.8%CVE-2026-6249HIGHVvveb CMS 1.0.8.2 Remote Code Execution via Media UploadEPSS 0.8%CVE-2026-40040HIGHPachno 1.0.6 Unrestricted File Upload Remote Code ExecutionEPSS 0.8%