Fallos del tipo CWE-434

3091 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2023-53868HIGHCoppermine Gallery 1.6.25 Remote Code Execution via Plugin UploadEPSS 0.9%CVE-2024-31345CRITICALWordPress Auto Poster plugin <= 1.2 - Arbitrary File Upload vulnerabilityEPSS 0.9%CVE-2026-13457HIGHInstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key DisclosureEPSS 0.9%CVE-2025-3125MEDIUMAuthenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code ExecutionEPSS 0.8%CVE-2021-37194—A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 onlEPSS 0.8%CVE-2023-6102MEDIUMMaiwei Safety Production Control Platform unrestricted uploadEPSS 0.8%CVE-2026-16060CRITICALInsert or Embed Articulate Content into WordPress <= 4.3000000027 - Editor+ Arbitrary File UploadEPSS 0.8%CVE-2024-13908HIGHSMTP by BestWebSoft <= 1.1.9 - Authenticated (Administrator+) Arbitrary File UploadEPSS 0.8%CVE-2023-47706MEDIUMIBM Security Guardium Key Lifecycle Manager file uploadEPSS 0.8%CVE-2017-7429HIGHFix for NetIQ shell code uploadEPSS 0.8%CVE-2023-6850MEDIUMkalcaddle KodExplorer API Endpoint unrestricted uploadEPSS 0.8%CVE-2025-54082HIGHnova-tiptap has an Unauthenticated Arbitrary File Upload VulnerabilityEPSS 0.8%CVE-2023-25444CRITICALWordPress JS Help Desk – Best Help Desk & Support Plugin plugin <= 2.7.7 - Arbitrary File Upload vulnerabilityEPSS 0.8%CVE-2023-7181MEDIUMMuyun DedeBIZ Add Attachment unrestricted uploadEPSS 0.8%CVE-2024-58348CRITICALWordPress Background Image Cropper 1.2 Remote Code ExecutionEPSS 0.8%CVE-2023-31585CRITICALGrocery-CMS-PHP-Restful-API v1.3 is vulnerable to File Upload via /admin/add-category.php.EPSS 0.8%CVE-2026-33647HIGHAVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File UploadEPSS 0.8%CVE-2025-47187HIGHA vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference UnEPSS 0.8%CVE-2026-6249HIGHVvveb CMS 1.0.8.2 Remote Code Execution via Media UploadEPSS 0.8%CVE-2026-40040HIGHPachno 1.0.6 Unrestricted File Upload Remote Code ExecutionEPSS 0.8%