Weaknesses of type CWE-434

3,099 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2023-53942CRITICALFile Thingie 2.5.7 Authenticated Arbitrary File Upload Remote Code ExecutionEPSS 0.6%CVE-2024-51789CRITICALWordPress Image Classify plugin <= 1.0.0 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2025-32957HIGHbaserCMS: unsafe File Upload Leading to Remote Code Execution (RCE)EPSS 0.6%CVE-2024-9280MEDIUMkalvinGit kvf-admin FileUploadKit.java fileUpload unrestricted uploadEPSS 0.6%CVE-2024-51792CRITICALWordPress Audio Record plugin <= 1.0 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2025-67968CRITICALWordPress Real Homes CRM plugin <= 1.0.0 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2024-5911HIGHPAN-OS: File Upload Vulnerability in the Panorama Web InterfaceEPSS 0.6%CVE-2023-20196MEDIUMTwo vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit tEPSS 0.6%CVE-2026-100389CRITICALGestSup before 3.2.61 Remote Code Execution via IMAP AttachmentEPSS 0.6%CVE-2025-13062HIGHSupreme Modules Lite <= 2.5.62 - Authenticated (Author+) Arbitrary File Upload via JSON Upload BypassEPSS 0.6%CVE-2023-50717MEDIUMNocoDB Allows Preview of File with Dangerous ContentEPSS 0.6%CVE-2024-22550MEDIUMAn arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi of ShopSite v14.0 allows attackers to execute arbitrary code EPSS 0.6%CVE-2024-52490CRITICALWordPress Pathomation plugin <= 2.5.1 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2024-13191MEDIUMZeroWdd myblog uploadController.java upload unrestricted uploadEPSS 0.6%CVE-2023-41812MEDIUMUploading executables via the file managerEPSS 0.6%CVE-2023-6794MEDIUMPAN-OS: File Upload Vulnerability in the Web InterfaceEPSS 0.6%CVE-2025-12057CRITICALWavePlayer < 3.8.0 - Unauthenticated Arbitrary File UploadEPSS 0.6%CVE-2024-12478MEDIUMInvoicePlane 1 upload_file unrestricted uploadEPSS 0.6%CVE-2024-12700HIGHTibbo AggreGate Network Manager Unrestricted Upload of File with Dangerous TypeEPSS 0.6%CVE-2026-13249CRITICALUnauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040EPSS 0.6%