Fallos del tipo CWE-434

3097 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2026-63048CRITICALJoomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2EPSS 0.4%CVE-2025-11103MEDIUMProjectworlds Online Tours and Travels change-image.php unrestricted uploadEPSS 0.4%CVE-2025-51511CRITICALCadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads.EPSS 0.4%CVE-2026-2665MEDIUMhuanzi-qch base-admin JSP Parser SysFileController.java upload unrestricted uploadEPSS 0.4%CVE-2025-49387CRITICALWordPress Drag and Drop File Upload for Elementor Forms Plugin <= 1.5.3 - Arbitrary File Upload VulnerabilityEPSS 0.4%CVE-2026-65939MEDIUMWhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.EPSS 0.4%CVE-2025-46078MEDIUMHuoCMS V3.5.1 and before is vulnerable to file upload, which allows attackers to take control of the target serverEPSS 0.4%CVE-2025-13815MEDIUMmoxi159753 Mogu Blog v2 pictures unrestricted uploadEPSS 0.4%CVE-2026-4586MEDIUMCodePhiliaX Chat2DB JDBC Driver Upload JdbcDriverController.java upload unrestricted uploadEPSS 0.4%CVE-2024-8725MEDIUMAdvanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Limited File UploadEPSS 0.4%CVE-2025-6837MEDIUMcode-projects Library System profile.php unrestricted uploadEPSS 0.4%CVE-2025-67924CRITICALWordPress Corpkit theme <= 2.0 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2026-7696MEDIUMAcrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform uploadH5Files unrestricted uploadEPSS 0.4%CVE-2025-11436MEDIUMJhumanJ OpnForm answer unrestricted uploadEPSS 0.4%CVE-2025-9406MEDIUMxuhuisheng lemon CmsArticleController.java uploadImage unrestricted uploadEPSS 0.4%CVE-2025-6900MEDIUMcode-projects Library System add-book.php unrestricted uploadEPSS 0.4%CVE-2024-13212MEDIUMSingMR HouseRent AddHouseController.java upload unrestricted uploadEPSS 0.4%CVE-2025-0402MEDIUM1902756969 reggie CommonController.java upload unrestricted uploadEPSS 0.4%CVE-2025-13544MEDIUMashraf-kabir travel-agency customer_register.php unrestricted uploadEPSS 0.4%CVE-2026-15518MEDIUMAREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted uploadEPSS 0.4%