Fallos del tipo CWE-434

3091 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2026-57700CRITICALWordPress OMGF Pro plugin <= 5.2.6 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2026-65885CRITICALJoomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2EPSS 0.5%CVE-2024-46373HIGHDedecms V5.7.115 contains an arbitrary code execution via file upload vulnerability in the backend.EPSS 0.5%CVE-2025-51056HIGHAn unrestricted file upload vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to write to arbitrary filesystEPSS 0.5%CVE-2021-39221MEDIUMXSS in ContactsEPSS 0.5%CVE-2023-5227MEDIUMUnrestricted Upload of File with Dangerous Type in thorsten/phpmyfaqEPSS 0.5%CVE-2024-49398HIGHUnrestricted Upload of File with Dangerous Type in Elvaco M-Bus Metering Gateway CMe3100EPSS 0.5%CVE-2025-47549CRITICALWordPress BEAF plugin <= 4.6.10 - Arbitrary File Upload VulnerabilityEPSS 0.5%CVE-2024-54285CRITICALWordPress SeedProd Pro plugin <= 6.18.10 - Remote Code Execution (RCE) vulnerabilityEPSS 0.5%CVE-2024-41913HIGHClariti Manager – Arbitrary File UploadEPSS 0.5%CVE-2025-32291CRITICALWordPress SUMO Affiliates Pro plugin < 11.1.0 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2025-12154HIGHAuto Thumbnailer <= 1.0 - Authenticated (Contributor+) Arbitrary File UploadEPSS 0.5%CVE-2025-34222CRITICALVasion Print (formerly PrinterLogic) Unauthenticated Admin APIs Used to Modify SSL CertificatesEPSS 0.5%CVE-2023-33930CRITICALWordPress Unlimited Elements For Elementor plugin <= 1.5.66 - Unrestricted Zip Extraction vulnerabilityEPSS 0.5%CVE-2025-12966HIGHAll-in-One Video Gallery 4.5.4 - 4.5.7 – Authenticated (Author+) Arbitrary File Upload via Import ZIPEPSS 0.5%CVE-2018-25388HIGHHaPe PKH 1.1 Arbitrary File Upload via aksi_foto.phpEPSS 0.5%CVE-2024-7944MEDIUMitsourcecode Laravel Property Management System DocumentsController.php UpdateDocumentsRequest unrestricted uploadEPSS 0.5%CVE-2025-48782CRITICALSoar Cloud HRD Human Resource Management System - Unrestricted Upload of File with Dangerous TypeEPSS 0.5%CVE-2024-10293MEDIUMZZCMS functions.php Ebak_SetGotoPak unrestricted uploadEPSS 0.5%CVE-2026-24330MEDIUMWildfly-core: wildfly: arbitrary file read via malicious archive deploymentEPSS 0.5%