Fallos del tipo CWE-434

3093 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2024-8242MEDIUMMStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File UploadEPSS 0.8%CVE-2025-66449HIGHConvertX has Path Traversal that leads to Arbitrary File Write and Arbitrary Code ExecutionEPSS 0.8%CVE-2023-40183HIGHDataEase has a vulnerability to obtain user cookiesEPSS 0.8%CVE-2024-25274CRITICALAn arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code EPSS 0.8%CVE-2025-11170CRITICALWP移行専用プラグイン for CPI <= 1.0.2 - Unauthenticated Arbitrary File UploadEPSS 0.8%CVE-2025-12674CRITICALKiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File UploadEPSS 0.8%CVE-2022-3682CRITICALSDM600 file permission validationEPSS 0.8%CVE-2023-6723CRITICALUnrestricted Upload of File with Dangerous Type in RepoxEPSS 0.8%CVE-2024-0505MEDIUMZhongFuCheng3y Austin Upload Material Menu MaterialController.java getFile unrestricted uploadEPSS 0.8%CVE-2023-5790MEDIUMSourceCodester File Manager App add-file.php unrestricted uploadEPSS 0.8%CVE-2021-3846MEDIUMUnrestricted Upload of File with Dangerous Type in firefly-iii/firefly-iiiEPSS 0.8%CVE-2026-26975HIGHMusic Assistant Server Path Traversal in Playlist Update API Allows Remote Code ExecutionEPSS 0.8%CVE-2024-28423CRITICALAirflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe_load function at cli.py. This vulneraEPSS 0.8%CVE-2024-33120CRITICALRoothub v2.5 was discovered to contain an arbitrary file upload vulnerability via the customPath parameter in the upload() function. This vuEPSS 0.8%CVE-2025-29287CRITICALAn arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crEPSS 0.8%CVE-2024-11979CRITICALInterinfo DreamMaker - Unrestricted File Upload through Path TraversalEPSS 0.8%CVE-2024-4197CRITICALAvaya IP Office One-X Portal File Upload VulnerabilityEPSS 0.8%CVE-2026-35164HIGHBrave CMS Sffected by Unrestricted File Upload via CKEditor EndpointEPSS 0.8%CVE-2024-38530CRITICALOpen eClass Platform allows Arbitrary File Upload in "modules/h5p/save.php"EPSS 0.8%CVE-2023-30090CRITICALSemcms Shop v4.2 was discovered to contain an arbitrary file uplaod vulnerability via the component SEMCMS_Upfile.php. This vulnerability alEPSS 0.8%