Fallos del tipo CWE-434

3099 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2024-42180LOWHCL MyXalytics is affected by a malicious file upload vulnerabilityEPSS 0.3%CVE-2026-1879MEDIUMHarvard University IQSS Dataverse Theme Customization ThemeAndWidgets.xhtml unrestricted uploadEPSS 0.3%CVE-2019-25627HIGHFlexHEX 2.71 Local Buffer Overflow via SEH UnicodeEPSS 0.3%CVE-2026-24673MEDIUMOpen eClass Has File Upload Filter Bypass via ZIP Archive ExtractionEPSS 0.3%CVE-2025-4648HIGHA user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.EPSS 0.3%CVE-2026-1126MEDIUMlwj flow SVG File FormResource.java uploadFile unrestricted uploadEPSS 0.3%CVE-2026-40487HIGHPostiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSSEPSS 0.3%CVE-2025-52449HIGHUnrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service moEPSS 0.3%CVE-2025-35032MEDIUMMedical Informatics Engineering Enterprise Health arbitrary file uploadEPSS 0.3%CVE-2026-88745MEDIUMEMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.EPSS 0.3%CVE-2026-1445MEDIUMiJason-Liu Books_Manager upload_bookCover.php unrestricted uploadEPSS 0.3%CVE-2025-61181MEDIUMdaicuocms V1.3.13 contains an arbitrary file upload vulnerability in the image upload feature.EPSS 0.3%CVE-2025-2350MEDIUMIROAD Dash Cam FX2 upload_file unrestricted uploadEPSS 0.3%CVE-2026-24034MEDIUMHorilla has File Upload XSSEPSS 0.3%CVE-2025-15415MEDIUMxnx3 wangmarket XML File uploadImage.do uploadImage unrestricted uploadEPSS 0.3%CVE-2026-79670MEDIUMEch0 before 4.4.3 Stored XSS via SVG UploadEPSS 0.3%CVE-2025-42883LOWInsecure File Operations vulnerability in SAP NetWeaver Application Server for ABAP (Migration Workbench)EPSS 0.3%CVE-2025-8764MEDIUMlinlinjava litemall upload unrestricted uploadEPSS 0.2%CVE-2025-55135MEDIUMIn Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats oEPSS 0.2%CVE-2023-53876MEDIUMAcademy LMS 6.1 Arbitrary File Upload Vulnerability via Profile SettingsEPSS 0.2%