Fallos del tipo CWE-434

3091 resultados

Upload irrestrito de arquivo com tipo perigoso

Ocorre quando a aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos. O risco é grave: o arquivo pode ser armazenado em local acessível pela web, executado pelo servidor, ou baixado e executado pela vítima.

Ejemplo

Um formulário de perfil aceita qualquer arquivo como 'foto', sem verificação. Alguém faz upload de um .exe ou .php; se salvo em pasta pública e com permissões erradas, o arquivo pode ser executado pelo servidor ou baixado por outros usuários.

Cómo mitigar

Valide a extensão e o tipo MIME no servidor (nunca apenas no cliente), rejeite extensões perigosas explicitamente, armazene uploads fora da raiz web ou sem permissão de execução, e considere renomear arquivos removendo extensão original. Idealmente, converta imagens para formatos seguros (PNG/JPG) após upload.

CVE-2025-3593MEDIUMZHENFENG13/code-projects My-Blog-layui authorImg upload unrestricted uploadEPSS 0.6%CVE-2025-32682CRITICALWordPress MapSVG Lite plugin <= 8.6.4 - Arbitrary File Upload VulnerabilityEPSS 0.6%CVE-2026-50124HIGHDataEase: Remote Code Execution (RCE) via Zip Protocol & File DropperEPSS 0.6%CVE-2025-34336MEDIUMeGovFramework <= 4.3.1 Unauthenticated File Upload via Web Editor Image Upload EndpointsEPSS 0.6%CVE-2021-24490—Email Artillery <= 4.1 - Arbitrary File UploadEPSS 0.6%CVE-2025-11318MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 uploadWxFile.do unrestricted uploadEPSS 0.6%CVE-2023-40051CRITICALProgress Application Server (PAS) for OpenEdge File Upload via Directory TraversalEPSS 0.6%CVE-2023-51475CRITICALWordPress WP MLM Unilevel Plugin <= 4.0 is vulnerable to Arbitrary File UploadEPSS 0.6%CVE-2024-56057CRITICALWordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary File Upload vulnerabilityEPSS 0.6%CVE-2024-58295HIGHElkArte Forum 1.1.9 Authenticated Remote Code Execution via Theme UploadEPSS 0.6%CVE-2022-46660HIGH An unauthorized user could alter or write files with full control over the path and content of the file. EPSS 0.6%CVE-2025-10907HIGHAuthenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code ExecutionEPSS 0.6%CVE-2023-25922MEDIUMIBM Security Guardium Key Lifecycle Manager file uploadEPSS 0.6%CVE-2023-24530HIGHSAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code thEPSS 0.6%CVE-2025-3765MEDIUMSourceCodester Web-based Pharmacy Product Management System edit-photo.php unrestricted uploadEPSS 0.6%CVE-2025-3764MEDIUMSourceCodester Web-based Pharmacy Product Management System edit-product.php unrestricted uploadEPSS 0.6%CVE-2025-3244MEDIUMSourceCodester Web-based Pharmacy Product Management System Create User Page add-admin.php unrestricted uploadEPSS 0.6%CVE-2026-1565HIGHUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Authenticated (Author+) Arbitrary File UploadEPSS 0.6%CVE-2025-69828CRITICALFile Upload vulnerability in TMS Global Software TMS Management Console v.6.3.7.27386.20250818 allows a remote attacker to execute arbitraryEPSS 0.6%CVE-2026-78839HIGHAn arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar filEPSS 0.6%