Fallos del tipo CWE-434

3091 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2026-2550CRITICALEFM iptime A6004MX timepro.cgi commit_vpncli_file_upload unrestricted uploadEPSS 0.9%CVE-2023-53924HIGHUliCMS 2023.1-sniffing-vicuna Remote Code Execution via Avatar UploadEPSS 0.9%CVE-2024-58281HIGHDotclear 2.29 Remote Code Execution via Authenticated File UploadEPSS 0.9%CVE-2023-25970CRITICALWordPress Zendrop – Global Dropshipping Plugin <= 1.0.0 is vulnerable to Arbitrary File UploadEPSS 0.9%CVE-2023-25909CRITICALHGiga Inc. OAKlouds - Arbitrary File UploadEPSS 0.9%CVE-2022-0409HIGHUnrestricted Upload of File with Dangerous Type in star7th/showdocEPSS 0.9%CVE-2023-32752CRITICALL7 Networks InstantScan & InstantQoS - Arbitrary File UploadEPSS 0.9%CVE-2023-3061MEDIUMcode-projects Agro-School Management System Attachment Image btn_functions.php unrestricted uploadEPSS 0.9%CVE-2026-74845HIGH2100 Technology｜Official Document Management System - Arbitrary File UploadEPSS 0.9%CVE-2023-46694HIGHVtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands. This flaw exEPSS 0.9%CVE-2026-77929HIGHClipBucket < 5.5.3-#182 Remote Code Execution via Photo Upload EndpointEPSS 0.9%CVE-2024-6319HIGHIMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload'EPSS 0.9%CVE-2024-6318HIGHIMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload_img_file'EPSS 0.9%CVE-2023-3274MEDIUMcode-projects Supplier Management System Picture btn_functions.php unrestricted uploadEPSS 0.9%CVE-2023-3503MEDIUMSourceCodester Shopping Website insert-product.php unrestricted uploadEPSS 0.9%CVE-2023-50692HIGHFile Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to EPSS 0.9%CVE-2025-10147CRITICALPodlove Podcast Publisher <= 4.2.6 - Unauthenticated Arbitrary File UploadEPSS 0.9%CVE-2024-0757MEDIUMInsert or Embed Articulate Content into WordPress <= 4.3000000023 - Author+ Upload to RCEEPSS 0.9%CVE-2024-5377MEDIUMSourceCodester Vehicle Management System newvehicle.php unrestricted uploadEPSS 0.9%CVE-2023-30333CRITICALAn arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrEPSS 0.9%