Fallos del tipo CWE-434

3088 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2025-34511HIGHSitecore PowerShell Extension RCE via Unrestricted UploadEPSS 29.8%CVE-2026-3891CRITICALPix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File UploadEPSS 29.7%CVE-2024-32002CRITICALGit's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code ExecutionEPSS 29.2%CVE-2023-50564HIGHAn arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary EPSS 29.1%CVE-2025-1128CRITICALEverest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and DeletionEPSS 28.8%CVE-2023-2648MEDIUMWeaver E-Office uploadify.php unrestricted uploadEPSS 28.5%CVE-2018-4063HIGHAn exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A speciEPSS 27.1%KEVCVE-2024-5247HIGHNETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution VulnerabilityEPSS 26.9%CVE-2023-5147MEDIUMD-Link DAR-7000 updateos.php unrestricted uploadEPSS 26.4%CVE-2023-3852MEDIUMOpenRapid RapidCMS upload.php unrestricted uploadEPSS 25.2%CVE-2022-1952—eaSYNC < 1.1.16 - Unauthenticated Arbitrary File UploadEPSS 24.9%CVE-2023-2924MEDIUMSupcon SimField reportupload.aspx unrestricted uploadEPSS 24.3%CVE-2022-0863—WP SVG Icons <= 3.2.3 - Admin+ Remote Code Execution (RCE)EPSS 23.8%CVE-2024-27747CRITICALFile Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the EPSS 23.6%CVE-2022-40878HIGHIn Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to achieve Remote Code ExeEPSS 23.2%CVE-2024-29974CRITICAL** UNSUPPORTED WHEN ASSIGNED ** The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versioEPSS 22.8%CVE-2023-5150MEDIUMD-Link DAR-7000/DAR-8000 web.php unrestricted uploadEPSS 22.7%CVE-2025-2005CRITICALFront-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File UploadEPSS 22.0%CVE-2022-40471CRITICALRemote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture uploaEPSS 21.8%CVE-2023-46474HIGHFile Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uploEPSS 21.2%