Fallos del tipo CWE-434

3091 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2025-8323HIGHVentem｜e-School - Arbitrary File UploadEPSS 0.6%CVE-2025-11657MEDIUMProjectsAndPrograms School Management System createNotice.php unrestricted uploadEPSS 0.6%CVE-2023-51421CRITICALWordPress Verge3D Plugin <= 4.5.2 is vulnerable to Arbitrary File UploadEPSS 0.6%CVE-2025-11659MEDIUMProjectsAndPrograms School Management System uploadNotes.php unrestricted uploadEPSS 0.6%CVE-2025-11656MEDIUMProjectsAndPrograms School Management System editNotes.php unrestricted uploadEPSS 0.6%CVE-2026-57581MEDIUMDotVVM: Unrestricted file uploadEPSS 0.6%CVE-2024-3123HIGHCHANGING Mobile One Time Password - Arbitrary File UploadEPSS 0.6%CVE-2024-2059MEDIUMSourceCodester Petrol Pump Management Software service_crud.php unrestricted uploadEPSS 0.6%CVE-2024-1260MEDIUMJuanpao JPShop API ComboController.php actionIndex unrestricted uploadEPSS 0.6%CVE-2025-29093HIGHFile Upload vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Content/GaEPSS 0.6%CVE-2020-37009HIGHMedDream PACS Server 6.8.3.751 - Remote Code ExecutionEPSS 0.6%CVE-2024-1262MEDIUMJuanpao JPShop API MaterialController.php actionUpdate unrestricted uploadEPSS 0.6%CVE-2024-1263MEDIUMJuanpao JPShop API PosterController.php actionUpdate unrestricted uploadEPSS 0.6%CVE-2024-0468MEDIUMcode-projects Fighting Cock Information System new-father.php unrestricted uploadEPSS 0.6%CVE-2025-15226CRITICALSunnet｜WMPro - Arbitrary File UploadEPSS 0.6%CVE-2024-1264MEDIUMJuanpao JPShop UploadsController.php actionUpdate unrestricted uploadEPSS 0.6%CVE-2025-61506CRITICALAn issue was discovered in MediaCrush thru 1.0.1 allowing remote unauthenticated attackers to upload arbitrary files of any size to the /uplEPSS 0.6%CVE-2024-1268MEDIUMCodeAstro Restaurant POS System update_product.php unrestricted uploadEPSS 0.6%CVE-2026-52835HIGHTautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_databaseEPSS 0.6%CVE-2024-5278MEDIUMUnrestricted File Upload leading to RCE in gaizhenbiao/chuanhuchatgptEPSS 0.6%