Weaknesses of type CWE-434

3,099 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2025-3593MEDIUMZHENFENG13/code-projects My-Blog-layui authorImg upload unrestricted uploadEPSS 0.6%CVE-2025-2035MEDIUMs-a-zhd Ecommerce-Website-using-PHP customer_register.php unrestricted uploadEPSS 0.6%CVE-2024-57450CRITICALChestnutCMS <=1.5.0 is vulnerable to File Upload via the Create template function.EPSS 0.6%CVE-2025-32682CRITICALWordPress MapSVG Lite plugin <= 8.6.4 - Arbitrary File Upload VulnerabilityEPSS 0.6%CVE-2025-34336MEDIUMeGovFramework <= 4.3.1 Unauthenticated File Upload via Web Editor Image Upload EndpointsEPSS 0.6%CVE-2026-50124HIGHDataEase: Remote Code Execution (RCE) via Zip Protocol & File DropperEPSS 0.6%CVE-2025-11318MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 uploadWxFile.do unrestricted uploadEPSS 0.6%CVE-2021-24490—Email Artillery <= 4.1 - Arbitrary File UploadEPSS 0.6%CVE-2023-40051CRITICALProgress Application Server (PAS) for OpenEdge File Upload via Directory TraversalEPSS 0.6%CVE-2024-56057CRITICALWordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2023-51475CRITICALWordPress WP MLM Unilevel Plugin <= 4.0 is vulnerable to Arbitrary File UploadEPSS 0.6%CVE-2022-46660HIGH An unauthorized user could alter or write files with full control over the path and content of the file. EPSS 0.6%CVE-2023-25922MEDIUMIBM Security Guardium Key Lifecycle Manager file uploadEPSS 0.6%CVE-2024-58295HIGHElkArte Forum 1.1.9 Authenticated Remote Code Execution via Theme UploadEPSS 0.6%CVE-2025-10907HIGHAuthenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code ExecutionEPSS 0.6%CVE-2023-24530HIGHSAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code thEPSS 0.6%CVE-2025-8255MEDIUMcode-projects Exam Form Submission register.php unrestricted uploadEPSS 0.6%CVE-2026-1565HIGHUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Authenticated (Author+) Arbitrary File UploadEPSS 0.6%CVE-2025-3764MEDIUMSourceCodester Web-based Pharmacy Product Management System edit-product.php unrestricted uploadEPSS 0.6%CVE-2025-3765MEDIUMSourceCodester Web-based Pharmacy Product Management System edit-photo.php unrestricted uploadEPSS 0.6%