Fallos del tipo CWE-434

3099 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2025-27127MEDIUMA vulnerability has been identified in TIA Project-Server (All versions < V2.1.1), TIA Project-Server V17 (All versions), Totally IntegratedEPSS 0.3%CVE-2025-67707MEDIUMUnvalidated File Upload vulnerability in ArcGIS Server.EPSS 0.3%CVE-2026-2213MEDIUMcode-projects Online Music Site AdminAddAlbum.php unrestricted uploadEPSS 0.3%CVE-2025-11020HIGHRemote Code Execution in MarkAny SafePC EnterpriseEPSS 0.3%CVE-2025-49222MEDIUMMattermost Shared Channel Upload Type Validation BypassEPSS 0.3%CVE-2024-50620HIGHUnrestricted Upload of File with Dangerous Type vulnerabilities exist in the rich text editor and document manage components in CIPPlanner CEPSS 0.3%CVE-2026-80050HIGHContiNew Admin through 4.1.0 Missing Authorization and File-Type Allowlist on Multipart Upload EndpointsEPSS 0.3%CVE-2026-32989HIGHPrecurio Intranet Portal 4.4: Cross-Site Request Forgery leading to arbitrary file uploadEPSS 0.3%CVE-2025-31048CRITICALWordPress Shopo <= 1.1.4 - Arbitrary File Upload VulnerabilityEPSS 0.3%CVE-2026-87928MEDIUMMaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_pageEPSS 0.3%CVE-2026-5695HIGHMultiple vulnerabilities in the Microweber administration panelEPSS 0.3%CVE-2025-62618HIGHELOG file upload stored XSSEPSS 0.3%CVE-2026-42538MEDIUMIRIS has an Insecure File UploadEPSS 0.3%CVE-2025-9314CRITICALDeveloper Tools <= 1.1.3 – Unauthenticated Arbitrary File UploadEPSS 0.3%CVE-2026-46426HIGHBudibase: Unrestricted Upload of File with Dangerous TypeEPSS 0.3%CVE-2025-55267MEDIUMHCL Aftermarket DPC is affected by Unrestricted File Upload vulnerabilityEPSS 0.3%CVE-2025-54460HIGHAVEVA PI Integrator Unrestricted Upload of File with Dangerous TypeEPSS 0.3%CVE-2021-47899MEDIUMYetiShare File Hosting Script 5.1.0 Remote File Upload SSRF VulnerabilityEPSS 0.3%CVE-2025-66837MEDIUMA file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code via uploading a crafted PDF file/MalwareEPSS 0.3%CVE-2025-54693CRITICALWordPress Form Block Plugin <= 1.5.5 - Arbitrary File Upload VulnerabilityEPSS 0.3%