Fallos del tipo CWE-434

3255 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2025-34100CRITICALBuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File UploadEPSS 3.9%CVE-2020-6008—LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code executionEPSS 3.8%CVE-2012-10019CRITICALFront-end Editor < 2.3 - Arbitrary File UploadEPSS 3.8%CVE-2024-31777CRITICALFile Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.pEPSS 3.8%CVE-2021-24376—Autoptimize < 2.7.8 - Arbitrary File Upload via "Import Settings"EPSS 3.7%CVE-2020-26285HIGHWidget instances allows a hacker to inject an executable file on the server on OpenMageEPSS 3.7%CVE-2023-3049CRITICALFile Upload in TMT's LockcellEPSS 3.7%CVE-2018-11091CRITICALAn issue was discovered in MyBiz MyProcureNet 5.0.0. A malicious file can be uploaded to the webserver by an attacker. It is possible for anEPSS 3.6%CVE-2023-2246MEDIUMSourceCodester Online Pizza Ordering System unrestricted uploadEPSS 3.6%CVE-2021-22697—A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 aEPSS 3.6%CVE-2015-10144HIGHResponsive Thumbnail Slider < 1.0.1 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 3.6%CVE-2023-4739MEDIUMByzoro Smart S85F Management Platform updateos.php unrestricted uploadEPSS 3.6%CVE-2026-58480CRITICALBlocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachmentsEPSS 3.6%CVE-2025-54769HIGHKL-001-2025-016: Xorux LPAR2RRD File Upload Directory TraversalEPSS 3.6%CVE-2024-9290CRITICALSuper Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File UploadEPSS 3.5%CVE-2021-44159CRITICAL4MOSAn GCB Doctor - Unrestricted Upload of FileEPSS 3.5%CVE-2026-5524CRITICALDivi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' ParameterEPSS 3.5%CVE-2026-14894CRITICALSuper Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)EPSS 3.5%CVE-2026-1405CRITICALSlider Future <= 1.0.5 - Unauthenticated Arbitrary File UploadEPSS 3.5%CVE-2021-4462CRITICALEmployee Records System v1.0 Arbitrary File Upload RCEEPSS 3.4%