Fallos del tipo CWE-434

3099 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2023-31428MEDIUMCLI allows upload or transfer files of dangerous typesEPSS 0.2%CVE-2026-9157HIGHRemote Code Execution in Gmission Web FAXEPSS 0.2%CVE-2026-30280MEDIUMAn arbitrary file overwrite vulnerability in RAREPROB SOLUTIONS PRIVATE LIMITED Video player Play All Videos v1.0.135 allows attackers to ovEPSS 0.2%CVE-2025-47939MEDIUMTYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction LayerEPSS 0.2%CVE-2026-27146HIGHGetSimple CMS: Cross-Site Request Forgery (CSRF) in File Upload Allows Arbitrary UploadsEPSS 0.2%CVE-2024-28520MEDIUMFile Upload vulnerability in Byzoro Networks Smart multi-service security gateway intelligent management platform version S210, allows an atEPSS 0.2%CVE-2024-47151MEDIUMSome Honor products are affected by file writing vulnerability, successful exploitation could cause code executionEPSS 0.2%CVE-2025-13462LOWtarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handlingEPSS 0.2%CVE-2025-24815HIGHAn unrestricted file upload vulnerability in Nokia MantaRay NMEPSS 0.2%CVE-2026-19219HIGHDialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAXEPSS 0.2%CVE-2025-15067HIGHUnrestricted File Upload and RCE in Innorix WPEPSS 0.1%CVE-2019-25616MEDIUMAnMing MP3 CD Burner 2.0 Local Denial of ServiceEPSS 0.1%CVE-2026-12264HIGHAuthenticated File Write via HA Failover Config Upload leads to RCEEPSS —CVE-2026-54675HIGHFreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang ModuleEPSS —CVE-2026-12269HIGHAuthenticated File Write to RCE via keepalived in DDI CentralEPSS —CVE-2026-102366LOWmall4j through 4.0 Unrestricted File Upload in Admin File EndpointsEPSS —CVE-2026-102263MEDIUMmwasikz robo-cafe-rms manage-food.php unrestricted uploadEPSS —CVE-2026-96431CRITICALFlowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous TypeEPSS —CVE-2026-101071MEDIUMAcrel Electric Unet Web Service Upload Endpoint upload unrestricted uploadEPSS —