Weaknesses of type CWE-434

3,096 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2024-51499HIGHMarkUs Arbitrary File Write leading up to remote code execution (student accounts)EPSS 0.7%CVE-2023-5796MEDIUMCodeAstro POS System Logo setting unrestricted uploadEPSS 0.7%CVE-2024-5145MEDIUMSourceCodester Vehicle Management System HTTP POST Request newdriver.php unrestricted uploadEPSS 0.7%CVE-2025-47787HIGHEmlog Pro Contains a File Upload VulnerabilityEPSS 0.7%CVE-2024-4923MEDIUMCodezips E-Commerce Site addproduct.php unrestricted uploadEPSS 0.7%CVE-2023-32628HIGH In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify thEPSS 0.7%CVE-2022-41217CRITICALCloudflow - Unauthenticated file upload vulnerabilityEPSS 0.7%CVE-2026-10818HIGHWPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize OrderingEPSS 0.7%CVE-2024-31615CRITICALThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php.EPSS 0.7%CVE-2024-10120MEDIUMwfh45678 Radar upload unrestricted uploadEPSS 0.7%CVE-2026-22766HIGHDell Wyse Management Suite, versions prior to WMS 5.5, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privEPSS 0.7%CVE-2023-26686CRITICALFile Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when custEPSS 0.7%CVE-2024-12954MEDIUM1000 Projects Portfolio Management System MCA update_ach.php unrestricted uploadEPSS 0.7%CVE-2025-34328CRITICALAudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated File Upload RCE via ajaxScript.phpEPSS 0.7%CVE-2024-40425CRITICALFile Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop (Spark Mall B2C Mall v.1.1.6 and before allows a remote attacker to eEPSS 0.7%CVE-2024-12953MEDIUM1000 Projects Portfolio Management System MCA update_pd_process.php unrestricted uploadEPSS 0.7%CVE-2024-35527CRITICALAn arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers EPSS 0.7%CVE-2026-13165HIGHRemote Code Execution in SzafirHostEPSS 0.7%CVE-2026-44088HIGHRemote Code Execution in SzafirHostEPSS 0.7%CVE-2026-5482CRITICALRemote Code Execution via Unrestricted File Upload in Responsive FileManagerEPSS 0.7%