Fallos del tipo CWE-434

3098 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2026-82524HIGHUnoPim File Upload RCE via TinyMCE Image Upload EndpointEPSS 0.6%CVE-2025-26776CRITICALWordPress Chaty Pro Plugin <= 3.3.3 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2024-31280CRITICALWordPress Church Admin plugin <= 4.1.5 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2025-7065CRITICALRemote Code Execution via Unrestricted File Upload in PAD CMSEPSS 0.6%CVE-2025-7063CRITICALRemote Code Execution via Unrestricted File Upload in PAD CMSEPSS 0.6%CVE-2024-7450MEDIUMitsourcecode Placement Management System Image resume_upload.php unrestricted uploadEPSS 0.6%CVE-2025-14849HIGHAdvantech WebAccess/SCADA Unrestricted Upload of File with Dangerous TypeEPSS 0.6%CVE-2024-50526CRITICALWordPress Multi Purpose Mail Form plugin <= 1.0.2 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2024-5043MEDIUMEmlog Pro setting.php unrestricted uploadEPSS 0.6%CVE-2025-57794CRITICALUnrestricted File Upload Vulnerability in Explorance BlueEPSS 0.6%CVE-2024-2599CRITICALUnrestricted Upload of File with Dangerous Type vulnerability in AMSS++EPSS 0.6%CVE-2023-39539HIGHFailure when uploading a Logo image fileEPSS 0.6%CVE-2024-48093HIGHUnrestricted File Upload in the Discussions tab in Operately v.0.1.0 allows a privileged user to achieve Remote Code Execution via uploadingEPSS 0.6%CVE-2023-1734HIGHSourceCodester Young Entrepreneur E-Negosyo System unrestricted uploadEPSS 0.6%CVE-2026-93352CRITICALLaravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File UploadEPSS 0.6%CVE-2026-16601HIGHCM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX ActionEPSS 0.6%CVE-2023-4817HIGHUnrestricted file upload vulnerability in ICP DAS ET-7060EPSS 0.6%CVE-2025-48106CRITICALWordPress Clanora theme < 1.3.1 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2024-4904MEDIUMByzoro Smart S200 Management Platform userattestation.php unrestricted uploadEPSS 0.6%CVE-2024-2406MEDIUMGacjie Server Upload.php index unrestricted uploadEPSS 0.6%