Fallos del tipo CWE-434

3083 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2025-34104CRITICALPiwik Authenticated RCE via Custom Plugin UploadEPSS 1.6%CVE-2023-23607CRITICALUnrestricted file upload leads to Remote Code Execution in erohtar/DasherrEPSS 1.6%CVE-2024-25414CRITICALAn arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code via uploading a crafteEPSS 1.6%CVE-2026-28270MEDIUMKiteworks Core has an Unrestricted Upload of File with Dangerous TypeEPSS 1.6%CVE-2021-21357HIGHBroken Access Control in Form FrameworkEPSS 1.6%CVE-2024-20272HIGHA vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arEPSS 1.6%CVE-2023-0265HIGHUvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application doeEPSS 1.6%CVE-2022-2594—Advanced Custom Fields 5.0-5.12.2 - Unauthenticated File UploadEPSS 1.6%CVE-2026-21536CRITICALMicrosoft Devices Pricing Program Remote Code Execution VulnerabilityEPSS 1.6%CVE-2021-32630CRITICALVariousEPSS 1.6%CVE-2020-10621—Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS (versions prior to 3.0.2).EPSS 1.6%CVE-2025-57642HIGHA Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and execute arbitrary PHP shell scripts on the seEPSS 1.6%CVE-2022-1045CRITICALStored XSS viva .svg file upload in polonel/trudeskEPSS 1.6%CVE-2024-13365CRITICALSecurity & Malware scan by CleanTalk <= 2.149 - Unauthenticated Arbitrary File UploadEPSS 1.6%CVE-2021-28173CRITICALVangene deltaFlow E-platform - Arbitrary File UploadEPSS 1.6%CVE-2021-24248—Business Directory Plugin < 5.11.1 - Authenticated PHP4 Upload to RCEEPSS 1.6%CVE-2018-25019—LearnDash < 2.5.4 - Unauthenticated Arbitrary File UploadEPSS 1.6%CVE-2024-52380CRITICALWordPress Picsmize plugin <= 1.0.0 - Arbitrary File Upload vulnerabilityEPSS 1.6%CVE-2023-6574MEDIUMByzoro Smart S20 HTTP POST Request updateos.php unrestricted uploadEPSS 1.6%CVE-2026-16447MEDIUMD-Link DNS-320 multi_uploadify.php unrestricted uploadEPSS 1.6%