Fallos del tipo CWE-434

3091 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2025-7931MEDIUMcode-projects Church Donation System admin_pic.php unrestricted uploadEPSS 0.5%CVE-2026-2978MEDIUMFastApiAdmin Scheduled Task API controller.py upload_file_controller unrestricted uploadEPSS 0.5%CVE-2025-12171HIGHRESTful Content Syndication 1.1.0 - 1.5.0 - Authenticated (Contributor+) Arbitrary File UploadEPSS 0.5%CVE-2025-6266MEDIUMTeledyne FLIR AX8 upload.php unrestricted uploadEPSS 0.5%CVE-2025-27692MEDIUMDell Wyse Management Suite, versions prior to WMS 5.1, contains an Unrestricted Upload of File with Dangerous Type vulnerability. A high priEPSS 0.5%CVE-2025-68986CRITICALWordPress Miion theme <= 1.2.7 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2025-11755HIGHDelicious Recipes <= 1.9.0 - Authenticated (Contributor+) Arbitrary File UploadEPSS 0.5%CVE-2025-9397MEDIUMgivanz Vvveb media.php unrestricted uploadEPSS 0.5%CVE-2025-11908MEDIUMShenzhen Ruiming Technology Streamax Crocus FileDir.do uploadFile unrestricted uploadEPSS 0.5%CVE-2026-2977MEDIUMFastApiAdmin Scheduled Task API controller.py upload_controller unrestricted uploadEPSS 0.5%CVE-2026-21662MEDIUMFMS Employee Allows Upload of Unrestricted FilesEPSS 0.5%CVE-2025-13094HIGHWP3D Model Import Viewer <= 1.0.7 - Authenticated (Contributor+) Arbitrary File UploadEPSS 0.5%CVE-2024-8338MEDIUMHFO4 shudong-share File Extension fileReceive.php unrestricted uploadEPSS 0.5%CVE-2025-5178MEDIUMRealce Tecnologia Queue Ticket Kiosk Image File ajax.php unrestricted uploadEPSS 0.5%CVE-2025-10009HIGHAuthenticated admin RCE in Invoice NinjaEPSS 0.5%CVE-2023-28814CRITICALSome versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability. Due to the improper verification of EPSS 0.5%CVE-2026-19513HIGHGravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash ConfusionEPSS 0.5%CVE-2025-54440CRITICALUnrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affEPSS 0.5%CVE-2026-18788MEDIUMTrippo ResponsiveFilemanager dialog.php unrestricted uploadEPSS 0.5%CVE-2020-37073HIGHVictor CMS 1.0 - Authenticated Arbitrary File UploadEPSS 0.5%