Fallos del tipo CWE-434

3095 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2022-46102CRITICALAyaCMS 3.1.2 is vulnerable to Arbitrary file upload via /aya/module/admin/fst_down.inc.phpEPSS 0.7%CVE-2022-45966CRITICALhere is an arbitrary file upload vulnerability in the file management function module of Classcms3.5.EPSS 0.7%CVE-2020-37117HIGHjizhiCMS 1.6.7 - Arbitrary File DownloadEPSS 0.7%CVE-2026-16985HIGHSqueeze < 1.7.12 - Author+ Arbitrary File UploadEPSS 0.7%CVE-2026-76552HIGHWP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image ImportEPSS 0.7%CVE-2026-77018HIGHWorkeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass AssignmentEPSS 0.7%CVE-2024-42777CRITICALAn Unrestricted file upload vulnerability was found in "/music/ajax.php?action=signup" of Kashipara Music Management System v1.0, which alloEPSS 0.7%CVE-2025-32579CRITICALWordPress Sync Posts Plugin <= 1.0 - Arbitrary File Upload vulnerabilityEPSS 0.7%CVE-2024-35510CRITICALAn arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.114 allows attackers to execute arbitrary code via uEPSS 0.7%CVE-2024-25994MEDIUMPHOENIX CONTACT: Unintended script file upload in CHARX SeriesEPSS 0.7%CVE-2026-22799CRITICALemlog Arbitrary File Upload VulnerabilityEPSS 0.7%CVE-2024-32256HIGHPhpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via /tms/admin/change-image.php. EPSS 0.7%CVE-2023-1739MEDIUMSourceCodester Simple and Beautiful Shopping Cart System upload.php unrestricted uploadEPSS 0.7%CVE-2025-2891HIGHWP Pro Real Estate 7 <= 3.5.4 - Authenticated (Custom) Arbitrary File UploadEPSS 0.7%CVE-2025-13329CRITICALFile Uploader for WooCommerce <= 1.0.3 - Unauthenticated Arbitrary File Upload via add-image-dataEPSS 0.7%CVE-2023-1558MEDIUMSimple and Beautiful Shopping Cart System uploadera.php unrestricted uploadEPSS 0.7%CVE-2025-0731MEDIUMSMA: Sunny Portal Remote Code ExecutionEPSS 0.7%CVE-2024-2604MEDIUMSourceCodester File Manager App update-file.php unrestricted uploadEPSS 0.7%CVE-2025-69906HIGHMonstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based fiEPSS 0.7%CVE-2024-36774HIGHAn arbitrary file upload vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary code via uploading a crafted PHP file.EPSS 0.7%