Fallos del tipo CWE-434

3098 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2025-67706MEDIUMUnvalidated File Upload vulnerability in ArcGIS Server.EPSS 0.4%CVE-2025-28951CRITICALWordPress Bulk Featured Image plugin <= 1.2.4 - Arbitrary File Upload vulnerabilityEPSS 0.4%CVE-2025-8265MEDIUM299Ko CMS File Management view unrestricted uploadEPSS 0.4%CVE-2026-6211HIGHArbitrary File Upload in Global IT's WEOLLEPSS 0.4%CVE-2025-61165CRITICALAn arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of cohere North AI v1.1.5 allows attackers to exeute arbitEPSS 0.4%CVE-2026-0577MEDIUMcode-projects Online Product Reservation System prod.php unrestricted uploadEPSS 0.4%CVE-2025-9415MEDIUMGreenCMS index.php unrestricted uploadEPSS 0.4%CVE-2026-32278HIGHConnect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form PluginEPSS 0.4%CVE-2025-0645HIGHArbitrary File Upload in Narkom Communication Technologies' Pyxis SignageEPSS 0.4%CVE-2026-22783CRITICALIris Allows Arbitrary File Deletion via Mass Assignment in Datastore File ManagementEPSS 0.4%CVE-2025-59524HIGHHorilla Stored XSS Vulnerability via File Upload in Reimbursement PanelEPSS 0.3%CVE-2025-4006MEDIUMyouyiio BeyongCms Document Management Page Upload.html unrestricted uploadEPSS 0.3%CVE-2025-10763MEDIUMacademico-sis academico Profile Picture edit-photo unrestricted uploadEPSS 0.3%CVE-2025-15009MEDIUMliweiyi ChestnutCMS Filename upload FilenameUtils.getExtension unrestricted uploadEPSS 0.3%CVE-2025-6848MEDIUMcode-projects Simple Forum forum1.php unrestricted uploadEPSS 0.3%CVE-2025-30169MEDIUMAdmin Authorized File Upload and Execute PHPEPSS 0.3%CVE-2025-30173MEDIUMAdmin Authorized File UploadEPSS 0.3%CVE-2025-14885MEDIUMSourceCodester Client Database Management System Leads Generation user_leads.php unrestricted uploadEPSS 0.3%CVE-2025-13573MEDIUMprojectworlds can pass malicious payloads add_book.php unrestricted uploadEPSS 0.3%CVE-2026-7044MEDIUMGreenCMS index.php themeadd unrestricted uploadEPSS 0.3%