Weaknesses of type CWE-434

3,098 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2026-82524HIGHUnoPim File Upload RCE via TinyMCE Image Upload EndpointEPSS 0.6%CVE-2025-26776CRITICALWordPress Chaty Pro Plugin <= 3.3.3 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2024-31280CRITICALWordPress Church Admin plugin <= 4.1.5 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2025-7065CRITICALRemote Code Execution via Unrestricted File Upload in PAD CMSEPSS 0.6%CVE-2025-7063CRITICALRemote Code Execution via Unrestricted File Upload in PAD CMSEPSS 0.6%CVE-2024-7450MEDIUMitsourcecode Placement Management System Image resume_upload.php unrestricted uploadEPSS 0.6%CVE-2025-14849HIGHAdvantech WebAccess/SCADA Unrestricted Upload of File with Dangerous TypeEPSS 0.6%CVE-2024-50526CRITICALWordPress Multi Purpose Mail Form plugin <= 1.0.2 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2024-5043MEDIUMEmlog Pro setting.php unrestricted uploadEPSS 0.6%CVE-2025-57794CRITICALUnrestricted File Upload Vulnerability in Explorance BlueEPSS 0.6%CVE-2024-2599CRITICALUnrestricted Upload of File with Dangerous Type vulnerability in AMSS++EPSS 0.6%CVE-2023-39539HIGHFailure when uploading a Logo image fileEPSS 0.6%CVE-2024-48093HIGHUnrestricted File Upload in the Discussions tab in Operately v.0.1.0 allows a privileged user to achieve Remote Code Execution via uploadingEPSS 0.6%CVE-2023-1734HIGHSourceCodester Young Entrepreneur E-Negosyo System unrestricted uploadEPSS 0.6%CVE-2026-93352CRITICALLaravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File UploadEPSS 0.6%CVE-2026-16601HIGHCM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX ActionEPSS 0.6%CVE-2023-4817HIGHUnrestricted file upload vulnerability in ICP DAS ET-7060EPSS 0.6%CVE-2025-48106CRITICALWordPress Clanora theme < 1.3.1 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2024-4904MEDIUMByzoro Smart S200 Management Platform userattestation.php unrestricted uploadEPSS 0.6%CVE-2024-2406MEDIUMGacjie Server Upload.php index unrestricted uploadEPSS 0.6%