Fallos del tipo CWE-434

3096 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2024-7903MEDIUMDedeBIZ File Extension media_add.php unrestricted uploadEPSS 0.7%CVE-2022-34482HIGHAn attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contaEPSS 0.7%CVE-2022-34483HIGHAn attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contaEPSS 0.7%CVE-2021-27771HIGHHCL Sametime is susceptible a file transfer service vulnerabilityEPSS 0.7%CVE-2024-8341MEDIUMSourceCodester Petshop Management System add_user.php unrestricted uploadEPSS 0.7%CVE-2023-1497MEDIUMSourceCodester Simple and Nice Shopping Cart Script uploaderm.php unrestricted uploadEPSS 0.7%CVE-2024-52769HIGHAn arbitrary file upload vulnerability in the component /admin/friendlink_edit of DedeBIZ v6.3.0 allows attackers to execute arbitrary code EPSS 0.7%CVE-2023-0918MEDIUMcodeprojects Pharmacy Management System Avatar Image add.php unrestricted uploadEPSS 0.7%CVE-2026-2334CRITICAL) Missing Server-Side File Extension Validation in vsDeskEPSS 0.7%CVE-2023-2776MEDIUMcode-projects Simple Photo Gallery unrestricted uploadEPSS 0.7%CVE-2025-27683HIGHVasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Driver Unrestricted Upload of File wEPSS 0.7%CVE-2012-10064CRITICALOmni Secure Files < 0.1.14 Unauthenticated Arbitrary File UploadEPSS 0.7%CVE-2025-39436CRITICALWordPress I Draw <= 1.0 - Arbitrary File Upload VulnerabilityEPSS 0.7%CVE-2024-4825CRITICALUnrestricted Upload of File with Dangerous Type vulnerability on Cockpit CMS from AgentejoEPSS 0.7%CVE-2024-51366CRITICALAn arbitrary file upload vulnerability in the component \Roaming\Omega of OmegaT v6.0.1 allows attackers to execute arbitrary code via uploaEPSS 0.7%CVE-2021-34619HIGHCross-Site Request Forgery in WooCommerce Stock Manager WordPress PluginEPSS 0.7%CVE-2024-32161CRITICALjizhiCMS 2.5 suffers from a File upload vulnerability.EPSS 0.7%CVE-2023-41788HIGHRemote Code Execution via File UploaderEPSS 0.7%CVE-2026-75169HIGHAn arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authentiEPSS 0.7%CVE-2024-51499HIGHMarkUs Arbitrary File Write leading up to remote code execution (student accounts)EPSS 0.7%