Fallos del tipo CWE-434

3098 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2026-14698MEDIUMSourceCodester Syllabus-Aligned Learning Management and Examination System upload_files.php unrestricted uploadEPSS 0.4%CVE-2026-91849MEDIUMWuzhiCMS Avatar Upload index.php setAvatar unrestricted uploadEPSS 0.4%CVE-2026-14776MEDIUMSourceCodester Onlne Examination & Learning Management System Filename Extension upload_files.php pathinfo unrestricted uploadEPSS 0.4%CVE-2026-90857MEDIUMSourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted uploadEPSS 0.4%CVE-2026-11344MEDIUMcode-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted uploadEPSS 0.4%CVE-2025-15423MEDIUMEmpireSoft EmpireCMS connect.php CheckSaveTranFiletype unrestricted uploadEPSS 0.4%CVE-2026-85186MEDIUMitsourcecode Online Medicine Delivery System Customer Controller controller.php doupdateimage unrestricted uploadEPSS 0.4%CVE-2026-77681MEDIUMCodeAstro Online Job Portal update-profile.php unrestricted uploadEPSS 0.4%CVE-2026-82679MEDIUMdiem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted uploadEPSS 0.4%CVE-2025-10085MEDIUMSourceCodester Pet Grooming Management Software manage_website.php unrestricted uploadEPSS 0.4%CVE-2026-1742MEDIUMEFM ipTIME A8004T VPN Service timepro.cgi commit_vpncli_file_upload unrestricted uploadEPSS 0.4%CVE-2023-43619—An issue was discovered in Croc through 9.6.5. A sender may send dangerous new files to a receiver, such as executable content or a .ssh/autEPSS 0.4%CVE-2026-29104LOWSuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRMEPSS 0.4%CVE-2025-12862MEDIUMprojectworlds Online Notes Sharing Platform userprofile.php unrestricted uploadEPSS 0.4%CVE-2024-34021MEDIUMUnrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. A specially crafted file may be uploadeEPSS 0.4%CVE-2024-13355MEDIUMAdmin and Customer Messages After Order for WooCommerce <= 13.2 - Authenticated (Subscriber+) Limited File Upload to Cross-Site ScriptingEPSS 0.4%CVE-2025-64374CRITICALWordPress Motors theme <= 5.6.81 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2024-13133MEDIUMZeroWdd studentmanager StudentController. java editStudent unrestricted uploadEPSS 0.4%CVE-2025-36174HIGHIBM Integrated Analytics System file uploadEPSS 0.4%CVE-2025-7190MEDIUMcode-projects Library Management System student_edit_photo.php unrestricted uploadEPSS 0.4%