Fallos del tipo CWE-434

3097 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2026-7238MEDIUMcode-projects Online Music Site AdminUpdateAlbum.php unrestricted uploadEPSS 0.4%CVE-2026-6561MEDIUMEyouCMS Index.php edit_adminlogo unrestricted uploadEPSS 0.4%CVE-2026-7134MEDIUMcode-projects Online Lot Reservation System edithousepic.php unrestricted uploadEPSS 0.4%CVE-2024-13134MEDIUMZeroWdd studentmanager TeacherController. java editTeacher unrestricted uploadEPSS 0.4%CVE-2026-19383MEDIUMsaithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted uploadEPSS 0.4%CVE-2026-5576MEDIUMSourceCodester/jkev Record Management System Add Employee save_emp.php unrestricted uploadEPSS 0.4%CVE-2026-4875MEDIUMitsourcecode Free Hotel Reservation System index.php unrestricted uploadEPSS 0.4%CVE-2026-7578MEDIUMMacCMS Pro Plugin Installation add.html install unrestricted uploadEPSS 0.4%CVE-2026-6650MEDIUMZ-BlogPHP ZBA File app_upload.php UnPack unrestricted uploadEPSS 0.4%CVE-2026-15518MEDIUMAREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted uploadEPSS 0.4%CVE-2026-7393MEDIUMSourceCodester Pizzafy Ecommerce System File Extension admin_class_novo.php save_menu unrestricted uploadEPSS 0.4%CVE-2026-7673MEDIUMcrmeb_java Admin Upload UploadServiceImpl.java unrestricted uploadEPSS 0.4%CVE-2026-16226MEDIUMSourceCodester Pizzafy Ecommerce System admin_class_novo.php save_settings unrestricted uploadEPSS 0.4%CVE-2025-14582MEDIUMcampcodes Online Student Enrollment System index.php unrestricted uploadEPSS 0.4%CVE-2025-8965MEDIUMlinlinjava litemall Endpoint AdminStorageController.java create unrestricted uploadEPSS 0.4%CVE-2025-65844HIGHEverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The eEPSS 0.4%CVE-2023-30962MEDIUMStored XSS in cerberus attachmentsEPSS 0.4%CVE-2025-15110MEDIUMjackq XCMS Backend ProductImageController.class.php upload unrestricted uploadEPSS 0.4%CVE-2026-46392HIGHHAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload ValidationEPSS 0.4%CVE-2024-41731LOWMultiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence PlatformEPSS 0.4%