Fallos del tipo CWE-434

3097 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2025-6667MEDIUMcode-projects Car Rental System add_cars.php unrestricted uploadEPSS 0.4%CVE-2026-11579MEDIUMKali Forms < 2.4.17 - Unauthenticated Media UploadEPSS 0.4%CVE-2025-12331MEDIUMWillow CMS add unrestricted uploadEPSS 0.4%CVE-2024-25182CRITICALgivanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php.EPSS 0.4%CVE-2024-27480CRITICALgivanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload.EPSS 0.4%CVE-2026-56414HIGHH.VIEW HV-500S6 IP Camera Unrestricted Upload of File with Dangerous TypeEPSS 0.4%CVE-2024-40693HIGHIBM Planning Analytics file uploadEPSS 0.4%CVE-2026-25648HIGHTraccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File UploadEPSS 0.4%CVE-2024-23811HIGHA vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application allows users to upload arbitrary files EPSS 0.4%CVE-2025-10000MEDIUMQyrr – simply and modern QR-Code creation <= 2.0.7 - Authenticated (Contributor+) Arbitrary File UploadEPSS 0.4%CVE-2026-2226MEDIUMDouPHP ZIP File file.php unrestricted uploadEPSS 0.4%CVE-2025-6466MEDIUMageerle ruoyi-ai SseServiceImpl.java upload unrestricted uploadEPSS 0.4%CVE-2026-39598HIGHWordPress Academy LMS Pro plugin < 3.5.2 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2025-69312CRITICALWordPress Xpro Elementor Addons plugin <= 1.4.19.1 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2023-23707MEDIUMWordPress Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files Plugin <= 2.7.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-67260HIGHThe Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vulnerability that may aEPSS 0.4%CVE-2025-14195MEDIUMcode-projects Employee Profile Management System add_file_query.php unrestricted uploadEPSS 0.4%CVE-2024-1932MEDIUMUnrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescoutEPSS 0.4%CVE-2026-12483HIGHLearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload HandlerEPSS 0.4%CVE-2025-7210MEDIUMcode-projects/Fabian Ros Library Management System profile_update.php unrestricted uploadEPSS 0.4%